masslogger

General

Target
New Order.exe
Size 1.0MB
Sample250418-ecc66stlt3
SHA256 7a3e83c0efa0df9503984fab1518df234f860e50af1c262ba3f0e62e97043c79
MD5 1abb13d716f83f0a9980509cda54507b
SHA1 ee1eb8d1207d5c5651f2a6abcff27218d64ee08b
SHA512 cfd2ecfc691958ae70bc82c495596a59ba3eea7d9f12be7daac0ee47b459aa1465bfaa2da5be4c0c7453efd5a5b73a6f337d596dd3ea19976b3e690b4c8a7d3a
SSDEEP 24576:+RgplwMOZpNkA+itElinh8NwJlkvLjdZ1XiLE:yqa7+CnhXzkvvdjWE
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

masslogger

C2

https://api.telegram.org/bot7634466618:AAGdqxrY8JcAwcfCQ1yWh0f65HLbeahdwGA/sendMessage?chat_id=5686701865

Attributes

exfiltration_mode
#TGEnabled
expire_time_date
2025-05-08
ssl_slate
False

Targets

- Target
  New Order.exe
- Size 1.0MB
- SHA256 7a3e83c0efa0df9503984fab1518df234f860e50af1c262ba3f0e62e97043c79
- MD5 1abb13d716f83f0a9980509cda54507b
- SHA1 ee1eb8d1207d5c5651f2a6abcff27218d64ee08b
- SHA512 cfd2ecfc691958ae70bc82c495596a59ba3eea7d9f12be7daac0ee47b459aa1465bfaa2da5be4c0c7453efd5a5b73a6f337d596dd3ea19976b3e690b4c8a7d3a
- SSDEEP 24576:+RgplwMOZpNkA+itElinh8NwJlkvLjdZ1XiLE:yqa7+CnhXzkvvdjWE
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

masslogger collection discovery spyware stealer
- MassLogger
  Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
  stealer spyware masslogger
- Masslogger family
  masslogger
- Drops startup file
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Masslogger family

Drops startup file

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2