masslogger

General

Target

611f0ae1632337b1d0ee2d5297ddfe300cc510c46266417bedd7c343ced0b264
Size

826KB
Sample

220730-12w68sacf6
MD5

63d39067eacc1eea38904299ab5ff856
SHA1

946b734a477803d315d319383c6f35f8d401c985
SHA256

611f0ae1632337b1d0ee2d5297ddfe300cc510c46266417bedd7c343ced0b264
SHA512

9d7c4588e20de7aa8e58a042ae486b7788dbf0cd64116df9e6256a2abc901730168d478a343d754cd642c1414b4e63738c9141d30c3bee97105c29b63d129e18

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\8B25A76FBE\Log.txt

Family

masslogger

Ransom Note

################################################################# MassLogger v1.3.4.0 ################################################################# ### Logger Details ### User Name: Admin IP: 154.61.71.51 Location: United States OS: Microsoft Windows 7 Ultimate 64bit CPU: Intel Core Processor (Broadwell) GPU: Standard VGA Graphics Adapter AV: NA Screen Resolution: 1280x720 Current Time: 7/30/2022 10:52:52 PM MassLogger Started: 7/30/2022 10:52:45 PM Interval: 2 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\pqI75Aqgj0J5fmF.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes:

Targets

- Target
  
  pqI75Aqgj0J5fmF.exe
- Size
  
  994KB
- MD5
  
  72115f284ae26d36cc4e0427fc3be420
- SHA1
  
  086b2d81c7913aac1f10632f34623356bf8cb081
- SHA256
  
  21178d3dc240fc60a328a125280b58e073cd8cb677553cc867a62fcdceca210f
- SHA512
  
  c29cd1e96a2d70ac1677806068614378bd4add58cc29b06a83f2abea1bf8151f930016cc97ec116ea3ad3ca0ad0598f27bfcaa267ca0be29df2948b5eb794f63
Score

10^/10

masslogger coreentity ransomware rezer0 spyware stealer
- CoreEntity .NET Packer
  A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.
  coreentity
- MassLogger
  Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
  stealer spyware masslogger
- MassLogger Main payload
- MassLogger log file
  Detects a log file produced by MassLogger.
- ReZer0 packer
  Detects ReZer0, a packer with multiple versions used in various campaigns.
  rezer0
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2