Overview

overview

10

Static

static

10

e64ff6e23c...05.exe

windows7-x64

10

e64ff6e23c...05.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e64ff6e23ce8911e74ee402d2cc1ed3d54998a56a6fb272b50c5a87363975305.exe

  • Size

    513KB

  • Sample

    230331-2cr2nadh97

  • MD5

    f32cbfaecc2e973799c7e8977a23fbc1

  • SHA1

    51a65b71f953c3e988f0a4a2d4e69ea6ca8b2b8f

  • SHA256

    e64ff6e23ce8911e74ee402d2cc1ed3d54998a56a6fb272b50c5a87363975305

  • SHA512

    85c3aea4fbca17e79833b33b73931b566b7d8ffa70318ac3c772054501105afd7bf659009b3c63550d8c9bcf803481e01341923071e2926c7bdc21b0ba9729c1

  • SSDEEP

    12288:DZ8M7gu9seB5mV+mMBYJf0hdrK8BnbPZl/xld44ILZn7EqhZ:DWM7gu9seB8gzBjde8BjZl/xTlIx

Score
10/10
massloggercollectionspywarestealer

Malware Config

Targets

    • Target

      e64ff6e23ce8911e74ee402d2cc1ed3d54998a56a6fb272b50c5a87363975305.exe

    • Size

      513KB

    • MD5

      f32cbfaecc2e973799c7e8977a23fbc1

    • SHA1

      51a65b71f953c3e988f0a4a2d4e69ea6ca8b2b8f

    • SHA256

      e64ff6e23ce8911e74ee402d2cc1ed3d54998a56a6fb272b50c5a87363975305

    • SHA512

      85c3aea4fbca17e79833b33b73931b566b7d8ffa70318ac3c772054501105afd7bf659009b3c63550d8c9bcf803481e01341923071e2926c7bdc21b0ba9729c1

    • SSDEEP

      12288:DZ8M7gu9seB5mV+mMBYJf0hdrK8BnbPZl/xld44ILZn7EqhZ:DWM7gu9seB8gzBjde8BjZl/xTlIx

    Score
    10/10
    massloggercollectionspywarestealer

    • MassLogger

      Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

      stealerspywaremasslogger

    • MassLogger Main payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks