General

  • Target

    a2b4d46606b331bdc9da63107c6271a59c60e7ea78922be4eeaccccbe3bde0bf

  • Size

    819KB

  • Sample

    220708-mh8h9sdge3

  • MD5

    0f2e4a2aefff2c984d82f29ce834669f

  • SHA1

    fbe05d756e7040b385adb24e22267da7038845b5

  • SHA256

    a2b4d46606b331bdc9da63107c6271a59c60e7ea78922be4eeaccccbe3bde0bf

  • SHA512

    56430acc54b1d79b153e1ada48b2b19bf3e51f6dea5aee201bfa7332604f9a784fee2bdb592e0ad0fc4a91d2d155a4c41bea9b5b70bf7bc0687862b70fb7bb85

Malware Config

Targets

    • Target

      a2b4d46606b331bdc9da63107c6271a59c60e7ea78922be4eeaccccbe3bde0bf

    • Size

      819KB

    • MD5

      0f2e4a2aefff2c984d82f29ce834669f

    • SHA1

      fbe05d756e7040b385adb24e22267da7038845b5

    • SHA256

      a2b4d46606b331bdc9da63107c6271a59c60e7ea78922be4eeaccccbe3bde0bf

    • SHA512

      56430acc54b1d79b153e1ada48b2b19bf3e51f6dea5aee201bfa7332604f9a784fee2bdb592e0ad0fc4a91d2d155a4c41bea9b5b70bf7bc0687862b70fb7bb85

    • MassLogger

      Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    • MassLogger Main payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Tasks