masslogger

General

Target

readerdc64_uk_gi_crd_mdr_install.exe
Size

1.2MB
Sample

220903-m42mvadggr
MD5

a2e37f954986af9f88342b20b2965646
SHA1

b298ce01bc93e8391acca3a07c0d06021df30dd6
SHA256

8bc36f61610304148652cc7748ac1a215290f720d9e5e8df53d1d3b2c3c0e5fd
SHA512

a492235f0e6de5f93200e0886bf4d3d77629777f28a5d517e87c3bb45e4266f339ab6a66d889434e617a3e4cec7248b488fb1e5aa0a73b6498ed7ec2d4073e7a
SSDEEP

24576:YDDuX33Kl7LoDozrFH1edTVyJFeMxbsRIHZ9lWzirNj:pHKFcD4FHnU+bhgo

Score

10^/10

Malware Config

Targets

- Target
  
  readerdc64_uk_gi_crd_mdr_install.exe
- Size
  
  1.2MB
- MD5
  
  a2e37f954986af9f88342b20b2965646
- SHA1
  
  b298ce01bc93e8391acca3a07c0d06021df30dd6
- SHA256
  
  8bc36f61610304148652cc7748ac1a215290f720d9e5e8df53d1d3b2c3c0e5fd
- SHA512
  
  a492235f0e6de5f93200e0886bf4d3d77629777f28a5d517e87c3bb45e4266f339ab6a66d889434e617a3e4cec7248b488fb1e5aa0a73b6498ed7ec2d4073e7a
- SSDEEP
  
  24576:YDDuX33Kl7LoDozrFH1edTVyJFeMxbsRIHZ9lWzirNj:pHKFcD4FHnU+bhgo
Score

10^/10

discovery evasion persistence trojan masslogger spyware stealer
- MassLogger
  Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
  stealer spyware masslogger
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Vidar log file
  Detects a log file produced by Vidar.
- Downloads MZ/PE file
- Executes dropped EXE
- Modifies Installed Components in the registry
  persistence
- Registers COM server for autorun
  persistence
- Sets file execution options in registry
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2