masslogger

General

Target

be736f5523597f921fac834bd2cb8723_JaffaCakes118
Size

970KB
Sample

240824-m381jawhna
MD5

be736f5523597f921fac834bd2cb8723
SHA1

41cd7abff56748ae7eac4cd35413078950749582
SHA256

64bf9e6d16667c6967da60414f0e3146ea6da3d8df4432a1c9289a11e3411bc2
SHA512

56cf66ef52a5c724125d45b76869b9fd0f3a09da6588de5d37888ca2a7b63dd012ca4a2cffb5aa06441a7f88f3d46d67939ab70ac4964a76ba4fe8a6fe2a454b
SSDEEP

24576:9+pbzwIxk4VdoqmoG8YPsICTA/8VaCnGgT:0pbkGtLKdEInEf

Score

10^/10

Malware Config

Targets

- Target
  
  be736f5523597f921fac834bd2cb8723_JaffaCakes118
- Size
  
  970KB
- MD5
  
  be736f5523597f921fac834bd2cb8723
- SHA1
  
  41cd7abff56748ae7eac4cd35413078950749582
- SHA256
  
  64bf9e6d16667c6967da60414f0e3146ea6da3d8df4432a1c9289a11e3411bc2
- SHA512
  
  56cf66ef52a5c724125d45b76869b9fd0f3a09da6588de5d37888ca2a7b63dd012ca4a2cffb5aa06441a7f88f3d46d67939ab70ac4964a76ba4fe8a6fe2a454b
- SSDEEP
  
  24576:9+pbzwIxk4VdoqmoG8YPsICTA/8VaCnGgT:0pbkGtLKdEInEf
Score

10^/10

masslogger collection credential_access discovery spyware stealer upx
- MassLogger
  Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
  stealer spyware masslogger
- MassLogger Main payload
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2