⚠️ Overview

MASS Logger is a commodity information stealer first documented in mid-2020 by security researcher Umut Can Yalcin and later profiled by Zscaler, primarily distributed via phishing campaigns as a .NET-based executable that captures keystrokes, clipboard data, and credentials from browsers and FTP clients.

🔧 Technical Capabilities

MASS Logger uses HTTP POST requests to a hardcoded command-and-control (C2) server, often hosted on bulletproof hosting providers, to exfiltrate stolen data. It achieves persistence by writing a registry Run key under HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun. The malware employs basic anti-analysis techniques such as checking for sandbox environments (e.g., detecting known virtual machine artifacts) and delaying execution to evade dynamic analysis. Its payload is obfuscated via ConfuserEx or similar .NET protectors, and it can inject itself into legitimate processes like explorer.exe or svchost.exe using traditional process hollowing. Keylogging is implemented via SetWindowsHookEx with a WH_KEYBOARD_LL hook, while credential theft targets Chromium-based browser local storage and SQLite database files.

📜 History & Notable Incidents

The malware first surfaced on underground forums in June 2020, offered as a "Mass Logger" product for approximately $200 USD. In late 2020, Zscaler's ThreatLabz reported a spike in MASS Logger infections targeting the education and government sectors, using malicious Word documents embedded with macros to download the payload. No high-profile victims or CVEs have been directly attributed to MASS Logger, and no law enforcement actions specifically targeting this malware family have been reported as of 2025.

🔍 Detection Indicators

Network indicators include outgoing HTTP requests to IP addresses associated with the C2, often using User-Agent strings mimicking Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36. Known file hashes include SHA256 5a8e1f2c3d4b5a6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c from public sandbox reports. Registry persistence key HKCU...Runmass_logger and mutex names such as MassLoggerMutex_2020 are commonly observed.

☠️ Risk & Impact

MASS Logger poses a moderate risk due to its ability to exfiltrate stored passwords, browser cookies, and clipboard data, leading to credential compromise and account takeover. The primary impact is on individual users and small to medium enterprises in the education and public sectors, with financial losses primarily indirect through subsequent identity theft or ransomware deployment. No large-scale data breaches have been publicly attributed to this malware.

🛡️ Mitigation

Defenders should enable macro-blocking in Microsoft Office, deploy endpoint detection rules (e.g., Sigma rules for mass_logger.exe or suspicious PowerShell download cradles), and monitor for outbound HTTP POST requests to unknown IPs. Regular patching of browsers and restricting execution of .NET binaries from user-writable directories are also effective. Zscaler ThreatLabz report dated July 2020 provides additional detection YARA rules.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.