Overview

overview

10

Static

static

EU Busines...er.exe

windows7_x64

10

EU Busines...er.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    EU Business Register.exe

  • Size

    1.9MB

  • Sample

    200624-97bz5lvdqe

  • MD5

    ada080e31c56a4d65a2e426890504121

  • SHA1

    6d0878ae4973f39cf0e61b6f5ddd662866435ae7

  • SHA256

    22d10edc3d0457dd81ee6cd9353e76b3208f8a549c290b80dea1efbbbe120c0b

  • SHA512

    4a31546103f75b54e1b33fd7dbc95ebd5573ee74b53dc45edf86de527fd6a89a560fde82dfa217956788b0bd9cd5415d80d349de016d86b9dad58d519a42c54f

Score
10/10
massloggerransomwarespywarestealer

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\C8A579F880\Log.txt

Family

masslogger

Ransom Note
################################################################# MassLogger v1.3.3.0 ################################################################# ### Logger Details ### User Name: Admin IP: 154.61.71.13 Location: United States OS: Microsoft Windows 7 Professional 64bit CPU: Persocon Processor 2.5+ GPU: Standard VGA Graphics Adapter AV: NA Screen Resolution: 1280x720 Current Time: 6/24/2020 5:38:14 PM MassLogger Started: 6/24/2020 5:38:01 PM Interval: 2 hour MassLogger Process: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe As Administrator: True

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.yandex.com
  • Port:
    587
  • Username:
    m4cfund@yandex.com
  • Password:
    Dmacdavid

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\740CAB5E8A\Log.txt

Family

masslogger

Ransom Note
################################################################# MassLogger v1.3.3.0 ################################################################# ### Logger Details ### User Name: Admin IP: 154.61.71.13 Location: United States OS: Microsoft Windows 10 Pro64bit CPU: Persocon Processor 2.5+ GPU: Microsoft Basic Display Adapter AV: NA Screen Resolution: 1280x720 Current Time: 6/24/2020 5:38:24 PM MassLogger Started: 6/24/2020 5:38:05 PM Interval: 2 hour MassLogger Process: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe As Administrator: True

Targets

    • Target

      EU Business Register.exe

    • Size

      1.9MB

    • MD5

      ada080e31c56a4d65a2e426890504121

    • SHA1

      6d0878ae4973f39cf0e61b6f5ddd662866435ae7

    • SHA256

      22d10edc3d0457dd81ee6cd9353e76b3208f8a549c290b80dea1efbbbe120c0b

    • SHA512

      4a31546103f75b54e1b33fd7dbc95ebd5573ee74b53dc45edf86de527fd6a89a560fde82dfa217956788b0bd9cd5415d80d349de016d86b9dad58d519a42c54f

    Score
    10/10
    ransomwarespywarestealermasslogger

    • MassLogger

      Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

      stealerspywaremasslogger

    • MassLogger log file

      Detects a log file produced by MassLogger.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spyware

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks