MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 045cfe04d64a1c71873d0fb2dbd1a48471f9918b1649b87ef001010dfc2a4286. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 4


Intelligence 4 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 045cfe04d64a1c71873d0fb2dbd1a48471f9918b1649b87ef001010dfc2a4286
SHA3-384 hash: f1e5192dd2a5d7b77a79d6e1fbdd54beb8f3157b88421c7474e1387d1364efb1e7adc9bf383218801a4176208a05a286
SHA1 hash: 2844d16734f437185092d1310d9b80ecb60af070
MD5 hash: 0cc6cc39359ab5ec6ef89e816bc9a72a
humanhash: georgia-crazy-asparagus-violet
File name:bravvvvvvv.exe
Download: download sample
Signature MassLogger
Create hunting rule
File size:1'220'096 bytes
First seen:2020-07-01 14:27:13 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:8MXciYRnm+l57O1/Sc8p1kgAx/Th5ucQjRtn:LXciInm+7E85A/5uJD
Threatray 677 similar samples on MalwareBazaar
TLSH 4645092A7985D920C5284636C4AAD980F3B1A68237A3DB0F74DB13484E0375FBF5B59F
Reporter James_inthe_box
Tags:exe MassLogger

Intelligence

File Origin
# of uploads :
1
# of downloads :
78
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/045cfe04d64a1c71873d0fb2dbd1a48471f9918b1649b87ef001010dfc2a4286/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-07-01 05:42:36 UTC
File Type:
PE (.Net Exe)
Extracted files:
35
AV detection:
21 of 29 (72.41%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=arop4bgwjiohdbz5b6znxuneqry7temlcze3q7xqaeaq37bkikda._file
Verdict:
unknown
Similar samples:
0ae98808b96b08f4de9c3c5cfdd54c2021c7fcd63b66965373c23a1376993831
MassLogger
43756195653d9b20db70b3b2700d6ece0e927da322db216d12e6eeb6af316f3f
MassLogger
50b298120d93f328fa5949eeb470a41ac0e846b28df37d46cb16c0beaa1b128e
MassLogger
5706101b5ffaf565a5690227f1c273b174eb2dcd3565904984a36be84eca6645
MassLogger
7fd925382882b58adc1b5e4a24a96d7fdcf3089f9badc5f6190489ddc9cb238a
MassLogger
bc13ffa3b767641ff58d98c8df48167b55c45fb97335b4819c4af8a57af47ff1
MassLogger
c744751ad79f737ac78fe9c69afac4c7b8940951b2fe67d20175d27e77721371
MassLogger
e67fc599ed1bffe0e2f9c8db8d5d355db6fe0960c466cd8e8ee9d07eb8714894
MassLogger
f98b35d218026beac9f13d886758bb0712fda3dc74ae7fbc5b29ce5fb63109ab
MassLogger
ff0b197ef34800ad007a5caedaf485af5ae523343ce8ec106d3a253d2c0a4a35
MassLogger
+ 667 additional samples on MalwareBazaar
Result
Malware family:
masslogger
Create hunting rule
Score:
  10/10
Tags:
ransomware persistence spyware stealer family:masslogger
Link:
https://tria.ge/reports/200701-9wy6svbjv2/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Adds Run entry to start application
Looks up external IP address via web service
Reads user/profile data of web browsers
Loads dropped DLL
Executes dropped EXE
MassLogger log file
MassLogger
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:masslogger_gcch
Create hunting rule
Author:govcert_ch

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/17682/

Comments