Overview

overview

10

Static

static

1

Congress.ps1

windows10-2004-x64

10

Congress.ps1

windows11-21h2-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    Congress.ps1
  • Size 87KB
  • Sample260427-dbbfhsbt7t
  • SHA256 7ac07536c76c62c163ceabf2e2e877fe3877b3414d95d36d50d8d5838a548fed
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
donutloadermassloggercollectionexecutionloaderspywarestealer

Malware Config

Extracted

Credentials
  • Protocol

    smtp
  • Host

    mail.taikei-rmc-co.biz
  • Port

    587
  • Username

    [email protected]
  • Password

    dy8tm;jRtJO[:bG:

Extracted

Family

  • masslogger

Attributes
  • exfiltration_mode

    #SMTPEnabled

  • expire_time_date

    2025-12-17

  • host_password

    dy8tm;jRtJO[:bG:

  • host_port

    587

  • host_receiver

    [email protected]

  • host_sender

    [email protected]

  • host_server

    mail.taikei-rmc-co.biz

  • ssl_slate

    True

Targets

    • Target
      Congress.ps1
    • Size 87KB
    • SHA256 7ac07536c76c62c163ceabf2e2e877fe3877b3414d95d36d50d8d5838a548fed
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    collectionexecutiondonutloadermassloggerloaderspywarestealer

    • Detects DonutLoader

      loader

    • Family: DonutLoader

      DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

      loaderdonutloader

    • Family: MassLogger

      Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

      stealerspywaremasslogger

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks