General

  • Target

    595687a02837220ef5ab639edaa40009.exe

  • Size

    833KB

  • Sample

    200630-exscwyryhj

  • MD5

    595687a02837220ef5ab639edaa40009

  • SHA1

    e65148cf7904cf2345622b586c6d51b7cc00f80a

  • SHA256

    399aa0c05acde43727cf4ba3973a85d62e44112641a4dcc91b8bc3bed88ac035

  • SHA512

    fe00e25ab68199299c7c03e96b210a08b5eb9285e4f342d337133515199e7891e3237389bbd03d1e1df6920b4a81070924285c0eabff0d03eddc4c0f1b14fb30

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\E2C1E8F1FA\Log.txt

Family

masslogger

Ransom Note
################################################################# MassLogger v1.3.7.1 ################################################################# ### Logger Details ### User Name: Admin IP: 154.61.71.51 Location: United States Windows OS: Microsoft Windows 7 Professional 64bit Windows Serial Key: HYF8J-CVRMY-CM74G-RPHKF-PW487 CPU: Persocon Processor 2.5+ GPU: Standard VGA Graphics Adapter AV: NA Screen Resolution: 1280x720 Current Time: 6/30/2020 12:47:00 PM MassLogger Started: 6/30/2020 12:46:54 PM Interval: 2 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\595687a02837220ef5ab639edaa40009.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes:

Targets

    • Target

      595687a02837220ef5ab639edaa40009.exe

    • Size

      833KB

    • MD5

      595687a02837220ef5ab639edaa40009

    • SHA1

      e65148cf7904cf2345622b586c6d51b7cc00f80a

    • SHA256

      399aa0c05acde43727cf4ba3973a85d62e44112641a4dcc91b8bc3bed88ac035

    • SHA512

      fe00e25ab68199299c7c03e96b210a08b5eb9285e4f342d337133515199e7891e3237389bbd03d1e1df6920b4a81070924285c0eabff0d03eddc4c0f1b14fb30

    • MassLogger

      Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    • MassLogger log file

      Detects a log file produced by MassLogger.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

1
T1081

Collection

Data from Local System

1
T1005

Tasks