masslogger | 489724de42867ea5123e311cab7fa980fcc9ffceaaea5c2149b216e178a1c9fa

General

Target
489724de42867ea5123e311cab7fa980fcc9ffceaaea5c2149b216e178a1c9fa.exe
Size 1.4MB
Sample260708-vpetjac16j
SHA256 489724de42867ea5123e311cab7fa980fcc9ffceaaea5c2149b216e178a1c9fa
MD5 a595ccae950c519c92c19ff59e400c6a
SHA1 dfc4c57a854afe5586189ccdd65b9310dbb4add9
SHA512 a24309dfb07e7aa00984ce3e27fdc6e625ce0396014762319083d312257d5276130f587902ab3b331a7a6c056755770a992fa22173c70f9e40504594c131a835
SSDEEP 24576:t5EmXFtKaL4/oFe5T9yyXYfP1ijXdaUboDrmuL8mih8V670Gk9TPC:tPVt/LZeJbInQRaUEDaL7C6W9T
TLSH
T17965BE0273C18062FEA691F30B76F6DD56BC69168123A53F13BC1979FD700A1DE2E662
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

masslogger

C2

https://api.telegram.org/bot7433626511:AAG6-SliBdFhddNZipC5HIcTnvhgatm6i28/sendMessage?chat_id=1780630805

Attributes

exfiltration_mode
#TGEnabled
expire_time_date
2298-07-03
ssl_slate
False

Targets

- Target
  489724de42867ea5123e311cab7fa980fcc9ffceaaea5c2149b216e178a1c9fa.exe
- Size 1.4MB
- SHA256 489724de42867ea5123e311cab7fa980fcc9ffceaaea5c2149b216e178a1c9fa
- MD5 a595ccae950c519c92c19ff59e400c6a
- SHA1 dfc4c57a854afe5586189ccdd65b9310dbb4add9
- SHA512 a24309dfb07e7aa00984ce3e27fdc6e625ce0396014762319083d312257d5276130f587902ab3b331a7a6c056755770a992fa22173c70f9e40504594c131a835
- SSDEEP 24576:t5EmXFtKaL4/oFe5T9yyXYfP1ijXdaUboDrmuL8mih8V670Gk9TPC:tPVt/LZeJbInQRaUEDaL7C6W9T
- TLSH
  T17965BE0273C18062FEA691F30B76F6DD56BC69168123A53F13BC1979FD700A1DE2E662
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection discovery masslogger spyware stealer
- Family: MassLogger
  Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
  stealer spyware masslogger
- Drops startup file
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: MassLogger

Drops startup file

Executes dropped EXE

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

AutoIT Executable

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2