Loading malware…
MassLogger is a modular .NET information-stealing malware family widely characterized as a credential stealer, keylogger, and spyware. Active since at least 2020 and sold on underground forums, it is commonly used in commodity cybercrime campaigns to harvest credentials and other sensitive user data from Windows systems. Observed targets include web browsers, email clients, messaging applications, FTP clients, VPN software, and collaboration-platform accounts, with reported theft of browser passwords, autofill data, email credentials, Discord tokens, clipboard contents, and keystrokes. Some variants also capture screenshots, collect host and security-product information, search for and upload files, and package stolen data for exfiltration.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
In some cases, threat actors have used office document file as initial infection vector with VBA macro and equation editor exploit... containing 2 VBScripts and 1 file of CVE-2017-11882 exploit... The excel sheet containing stack-based buffer overflow editor exploit of the equation editor renames and executes VB Scripts using WinExec api post-exploitation. | We have been dealing with a new spyware for the past two months, named MassLogger. This advanced keylogger and spyware are distributed via MalSpam attachments...
32 distinct techniques documented for this family, organized by ATT&CK tactic.
USB Spread, it uses an open-source code of LimeUSB... It is used to infect files stored on the USB drive.
After that, to stay persistent in the system, it creates an entry in task scheduler.
These threats demonstrate several techniques of the MITRE ATT&CK framework, most notably... T1059.001... The second stage is a PowerShell script that eventually deobfuscates into a downloader and downloads and loads the main PowerShell loader.
In some cases, threat actors have used office document file as initial infection vector with VBA macro and equation editor exploit. | The first stream oleObject1.bin is a VB script file contains renamer code and after which it executes VBS file using Wscript.
After that, to stay persistent in the system, it creates an entry in task scheduler.
OleObject2.bin stream is also a VB script which is highly obfuscated... The Lazarus.exe gets dumped which is highly obfuscated .NET file... All function and class names are modified to random/obfuscated string.
The sample we investigated starts itself in a new process, allocates executable memory and injects the mentioned routine into the newly created process via Process Injection.
Following image shows the use of the self-hollowing technique to do its further activity.
These threats demonstrate several techniques of the MITRE ATT&CK framework, most notably... T1140 — Deobfuscate/Decode Files or Information... Every stage of the infection is obfuscated to avoid detection using simple signatures.
These threats demonstrate several techniques of the MITRE ATT&CK framework, most notably... T1056.001 — Keylogging... Masslogger can be configured as a keylogger, but in this case, the actor has disabled this functionality.
A Discord access token is a unique alphanumeric string that is generated for each user and is essentially the "key" to that user's account. If another party were to have access to this token it would allow them to have full control over that account.
The new process starts to iterate over files holding login credentials and writes them into a new file.
These threats demonstrate several techniques of the MITRE ATT&CK framework, most notably... T1555.003 — Credentials from Web Browsers... The main payload is a variant of the Masslogger trojan designed to retrieve and exfiltrate user credentials from a variety of sources.
also gets running process information. MassLogger also stores a running process windows name in its log file.
It starts collecting system information like name of the system, Windows version, CPU, GPU, AV installed, Public IP... also gets running process information.
It also has Anti-VM techniques by checking for Video_Controller adapter using WMI
These threats demonstrate several techniques of the MITRE ATT&CK framework, most notably... T1056.001 — Keylogging... Masslogger can be configured as a keylogger, but in this case, the actor has disabled this functionality.
These threats demonstrate several techniques of the MITRE ATT&CK framework, most notably... T1115— Clipboard Data.
However, any data can be sent to a webhook, allowing for data exfiltration.
the variant we investigated tried to send the results over SMTP to the c2 server. We also identified that MassLogger can atleast be configured to transfer the logging results via FTP to its control server.
These threats demonstrate several techniques of the MITRE ATT&CK framework, most notably... T1048.003 — Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol... The exfiltration of data takes place over one or more of these channels: FTP... HTTP... SMTP.
192 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
27 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Keylogging and credential-stealing malware family observed as an alternate payload from the same infrastructure.
Alternate payload family seen in related samples from the same campaign infrastructure; also found in metadata-linked samples alongside Remcos.
MassLogger is an infostealer used alongside XWorm in the same infrastructure, specifically for credential harvesting.
Credential theft/keylogging malware delivered as a secondary payload (here, via QuirkyLoader).
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.