masslogger

General

Target

ecad32280bbd5601b22a12b8ebb7124f_JaffaCakes118
Size

688KB
Sample

240920-c3rfdathrd
MD5

ecad32280bbd5601b22a12b8ebb7124f
SHA1

beeb525154606abbf5773ad9489ab4fd35089bcf
SHA256

a855cffb375c1169d6b6a6f1690f19037eabce6a4b546864ab6c2a686edf01a5
SHA512

9d5423a9fefc562fdf9b137a1810be1115751b5b38495af8e38154229ea1278321ca4951e72cd9bd1625e6ea55f2a928a635d9c8c83a08c3cc3a3dea1406d16c
SSDEEP

12288:Wp+TkKh7nw5NVhSGnjZgpsWjrqjj0IM1F4BCkyGsOZl8v0u+c3wE2ZJ2EISp3uK:K+AMrSnSpFjWjhhIky7OTJuXwEiJ5xp3

Score

10^/10

Malware Config

Targets

- Target
  
  ecad32280bbd5601b22a12b8ebb7124f_JaffaCakes118
- Size
  
  688KB
- MD5
  
  ecad32280bbd5601b22a12b8ebb7124f
- SHA1
  
  beeb525154606abbf5773ad9489ab4fd35089bcf
- SHA256
  
  a855cffb375c1169d6b6a6f1690f19037eabce6a4b546864ab6c2a686edf01a5
- SHA512
  
  9d5423a9fefc562fdf9b137a1810be1115751b5b38495af8e38154229ea1278321ca4951e72cd9bd1625e6ea55f2a928a635d9c8c83a08c3cc3a3dea1406d16c
- SSDEEP
  
  12288:Wp+TkKh7nw5NVhSGnjZgpsWjrqjj0IM1F4BCkyGsOZl8v0u+c3wE2ZJ2EISp3uK:K+AMrSnSpFjWjhhIky7OTJuXwEiJ5xp3
Score

10^/10

masslogger collection credential_access discovery execution spyware stealer
- MassLogger
  Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
  stealer spyware masslogger
- MassLogger Main payload
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2