Overview

overview

10

Static

static

1

f756360e7d...18.ps1

windows7-x64

10

f756360e7d...18.ps1

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f756360e7d811838662048f6e84e25f9_JaffaCakes118

  • Size

    1.1MB

  • Sample

    240926-cpn34avbkg

  • MD5

    f756360e7d811838662048f6e84e25f9

  • SHA1

    c918a3b84569b51fde7b2bd8945d1abd20497ab4

  • SHA256

    ff9eb59b1a6ad5a60f4b2e951555040b9ded10187eba3545f3ab9d3730b84b8a

  • SHA512

    ec68888d2dfdd83c92b621beb084188a2e591fbe8e564d9bda0de86a51245216157803ef757903c4055c2c5f4eca44bba85ee60c03f5decb8421b1b95f471fad

  • SSDEEP

    12288:pz+ksOfuMAH9TOovlzJSOFtS9AWGvVDgNnl/xSVOrq:X2My96ovfVOe

Score
10/10
massloggercollectiondiscoveryexecutionspywarestealer

Malware Config

Targets

    • Target

      f756360e7d811838662048f6e84e25f9_JaffaCakes118

    • Size

      1.1MB

    • MD5

      f756360e7d811838662048f6e84e25f9

    • SHA1

      c918a3b84569b51fde7b2bd8945d1abd20497ab4

    • SHA256

      ff9eb59b1a6ad5a60f4b2e951555040b9ded10187eba3545f3ab9d3730b84b8a

    • SHA512

      ec68888d2dfdd83c92b621beb084188a2e591fbe8e564d9bda0de86a51245216157803ef757903c4055c2c5f4eca44bba85ee60c03f5decb8421b1b95f471fad

    • SSDEEP

      12288:pz+ksOfuMAH9TOovlzJSOFtS9AWGvVDgNnl/xSVOrq:X2My96ovfVOe

    Score
    10/10
    massloggercollectiondiscoveryexecutionspywarestealer

    • MassLogger

      Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

      stealerspywaremasslogger

    • MassLogger Main payload

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks