Overview

overview

10

Static

static

3

PAYMENT DE...ON.exe

windows7-x64

10

PAYMENT DE...ON.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d3c9458cd2f55265a139756dd79c5ac3_JaffaCakes118

  • Size

    877KB

  • Sample

    240908-hm7qbasdjn

  • MD5

    d3c9458cd2f55265a139756dd79c5ac3

  • SHA1

    da9c18202cef635f45fa72f0435518a95b65ed4b

  • SHA256

    d24c4c9b26b2dce1de2a0797c2e46fc5f58e342930d8ced675680a250fd22ba8

  • SHA512

    adc0cb7aec64e59c6f941316e84182ee723be4d57a1c59e735058dfd61a1b110292484ccc70a72ef13a0ddad8b503334fa05fc758fcab20b855fb115ab22ec1e

  • SSDEEP

    24576:CVsCLPd/gUYFzPU3K6yRR1/ZQGChLvdugS3VRNh0b4E:CjPGJsC1/ZQGCh5hGNh6L

Score
10/10
massloggerdefense_evasiondiscoveryevasionspywarestealer

Malware Config

Targets

    • Target

      PAYMENT DETAILS CONFIRMATION.exe

    • Size

      992KB

    • MD5

      73c81dd67773b2efa5261e20adf74a5b

    • SHA1

      fde0db688d6abb4aad0bb646db9f1c192d980b5a

    • SHA256

      ad32cadc3a75e969c0e8c25dfec398378aceb406017050763ce3c5d482998f42

    • SHA512

      8b2483b0dedf9d6b9329202d40544291b55601518c3b14f5df764e277114ee6538bdf6d08efcb8c3dad99ac7368471354acb1bf1ecd3f7da2c072f8c5a8e24d9

    • SSDEEP

      24576:8I3j32qQLhX/CUoDnbUVo2yhVx/NOMCh/zduiMxVRPXQJA:j6DhaJAMx/NOMChxp8PXg

    Score
    10/10
    massloggerdefense_evasiondiscoveryevasionspywarestealer

    • MassLogger

      Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

      stealerspywaremasslogger

    • MassLogger Main payload

    • Looks for VirtualBox Guest Additions in registry

      evasion

    • Looks for VMWare Tools registry key

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Deletes itself

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

      defense_evasion

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks