masslogger

General

Target

43971b982d0d0019c55f59c52254eee0_JaffaCakes118
Size

821KB
Sample

240729-nlabbawfjp
MD5

43971b982d0d0019c55f59c52254eee0
SHA1

567a0266c45f2759a7eb95b392a2052ccc00c066
SHA256

49de80d921b1b300f98b33bcd37b92e8b271e2d8dc8e27d6990d66aa21b5fb8d
SHA512

05ee55860bfde7b59d1f22695a12fcd4794dc5053cf76c598b11c20e2c2b9fc1fb1142c70488f94657f02e36ce38c2335274b778f3070eec7d3207448de23d59
SSDEEP

24576:lusRkCMqlJIw2z+yqdIrWO5K9jARfW6cZVvJs2:lusR3MrpDrhg9jAw6cZRe2

Score

10^/10

Malware Config

Targets

- Target
  
  43971b982d0d0019c55f59c52254eee0_JaffaCakes118
- Size
  
  821KB
- MD5
  
  43971b982d0d0019c55f59c52254eee0
- SHA1
  
  567a0266c45f2759a7eb95b392a2052ccc00c066
- SHA256
  
  49de80d921b1b300f98b33bcd37b92e8b271e2d8dc8e27d6990d66aa21b5fb8d
- SHA512
  
  05ee55860bfde7b59d1f22695a12fcd4794dc5053cf76c598b11c20e2c2b9fc1fb1142c70488f94657f02e36ce38c2335274b778f3070eec7d3207448de23d59
- SSDEEP
  
  24576:lusRkCMqlJIw2z+yqdIrWO5K9jARfW6cZVvJs2:lusR3MrpDrhg9jAw6cZRe2
Score

10^/10

masslogger collection credential_access discovery rezer0 spyware stealer
- MassLogger
  Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
  stealer spyware masslogger
- MassLogger Main payload
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- ReZer0 packer
  Detects ReZer0, a packer with multiple versions used in various campaigns.
  rezer0
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2