General

  • Target

    9239826853_awb_20221221_514_20221221.exe

  • Size

    576KB

  • Sample

    221229-cfr4dscb59

  • MD5

    a27337fabd21bf9cd0eb1b339109c62c

  • SHA1

    8a4c92e398aacafe78987caefe5bc55f984a41ec

  • SHA256

    00b8e2f4f20cea62efb3ffaf667f36ca4afaeffd3f7ccc5762d753422503be1e

  • SHA512

    09bda15ceb928d57295407187290dbc21f26d08a64a8ab4fe564cabf306b928d42fe50bb554e9efdb59d833cec96a4fe513c588fca7737a274eb9a3b1fa5d0d1

  • SSDEEP

    12288:fglVoI8ntiqXOsZtMgBzsSJ/zaGvkRUPFSUEWqf4sLrK9:6qJMGHlza4FS/X2

Malware Config

Targets

    • Target

      9239826853_awb_20221221_514_20221221.exe

    • Size

      576KB

    • MD5

      a27337fabd21bf9cd0eb1b339109c62c

    • SHA1

      8a4c92e398aacafe78987caefe5bc55f984a41ec

    • SHA256

      00b8e2f4f20cea62efb3ffaf667f36ca4afaeffd3f7ccc5762d753422503be1e

    • SHA512

      09bda15ceb928d57295407187290dbc21f26d08a64a8ab4fe564cabf306b928d42fe50bb554e9efdb59d833cec96a4fe513c588fca7737a274eb9a3b1fa5d0d1

    • SSDEEP

      12288:fglVoI8ntiqXOsZtMgBzsSJ/zaGvkRUPFSUEWqf4sLrK9:6qJMGHlza4FS/X2

    • MassLogger

      Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    • MassLogger Main payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Tasks