Overview

overview

10

Static

static

3

c681559b99...18.exe

windows7-x64

10

c681559b99...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c681559b99ec45b7deb597342f829ad1_JaffaCakes118

  • Size

    1.1MB

  • Sample

    240828-kdrzlstalr

  • MD5

    c681559b99ec45b7deb597342f829ad1

  • SHA1

    f9c264ea9987b2377293ebad0722b6389ffe4c99

  • SHA256

    b8eccd094b6d3295838e91b54c25c81c86dcd0786543524f6c9e5c5108484c03

  • SHA512

    804ff57a342d67c5126ea8b54c03afb031d7b51e814e633657e8e91ffdb3c09b2d0271b6649471c10dbdb0388d6f9816cdc3f649b9151916bf7c7fb3e74c388b

  • SSDEEP

    24576:vyB2j24zrtOTFKKpDQGXsqMGUEiVJElns1fFOXUTlmJ17G6+:zFrtOTFpyqMtlf1fQUTl

Score
10/10
massloggerdefense_evasiondiscoveryspywarestealer

Malware Config

Targets

    • Target

      c681559b99ec45b7deb597342f829ad1_JaffaCakes118

    • Size

      1.1MB

    • MD5

      c681559b99ec45b7deb597342f829ad1

    • SHA1

      f9c264ea9987b2377293ebad0722b6389ffe4c99

    • SHA256

      b8eccd094b6d3295838e91b54c25c81c86dcd0786543524f6c9e5c5108484c03

    • SHA512

      804ff57a342d67c5126ea8b54c03afb031d7b51e814e633657e8e91ffdb3c09b2d0271b6649471c10dbdb0388d6f9816cdc3f649b9151916bf7c7fb3e74c388b

    • SSDEEP

      24576:vyB2j24zrtOTFKKpDQGXsqMGUEiVJElns1fFOXUTlmJ17G6+:zFrtOTFpyqMtlf1fQUTl

    Score
    10/10
    massloggerdefense_evasiondiscoveryspywarestealer

    • MassLogger

      Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

      stealerspywaremasslogger

    • MassLogger Main payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

      defense_evasion

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks