MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 06b02574925948a3f418ba2851f10585086a5f9b25d8f4e7de62dd52c6a56153. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
MassLogger
Vendor detections: 15
| SHA256 hash: | 06b02574925948a3f418ba2851f10585086a5f9b25d8f4e7de62dd52c6a56153 |
|---|---|
| SHA3-384 hash: | 51588c7e49f8f48c1217b37825ea508041d0a4777bbc24539255e4ba2c315f21c60dc15bb497a917eb771add511a7f72 |
| SHA1 hash: | ecc3e77b970e198dfe6ab4bdee2fe460e79722cb |
| MD5 hash: | 3ec6a74171c7f6fe3cd9727b7a5907de |
| humanhash: | sink-hot-fix-illinois |
| File name: | SKLP098765400-987656.exe |
| Download: | download sample |
| Signature | MassLogger |
| File size: | 1'191'596 bytes |
| First seen: | 2022-10-13 10:43:33 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | fcf1390e9ce472c7270447fc5c61a0c1 (863 x DCRat, 118 x NanoCore, 94 x njrat) |
| ssdeep | 24576:BAOcZXdz3f0moRKs8EVnkF1EjCRLCC2ylYglQTQD3tAFRosik:b4CK5ok4jjC2ylYgaGtArZN |
| Threatray | 2'007 similar samples on MalwareBazaar |
| TLSH | T1CD451202B7C2C8B1D1731A309A35B6112A3D7D202E74CB2FB3E4756DEF31951A626B67 |
| TrID | 91.0% (.EXE) WinRAR Self Extracting archive (4.x-5.x) (265042/9/39) 3.6% (.EXE) Win64 Executable (generic) (10523/12/4) 1.7% (.EXE) Win16 NE executable (generic) (5038/12/1) 1.5% (.EXE) Win32 Executable (generic) (4505/5/1) 0.6% (.EXE) OS/2 Executable (generic) (2029/13) |
| File icon (PE): |  |
| dhash icon | b0b0b0b0a0b0b08e (10 x SnakeKeylogger, 1 x OskiStealer, 1 x AgentTesla) |
| Reporter |  abuse_ch |
| Tags: | exe MassLogger |
Intelligence
File Origin
# of uploads :
1
# of downloads :
242
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Snake
Result
Verdict:
Malware
Maliciousness:
Behaviour
Searching for the window
Creating a window
Сreating synchronization primitives
Searching for synchronization primitives
Creating a file in the %temp% subdirectories
Enabling the 'hidden' option for files in the %temp% directory
Creating a process from a recently created file
Creating a file
Adding an access-denied ACE
Launching a process
DNS request
Sending an HTTP GET request
Reading critical registry keys
Unauthorized injection to a system process
Result
Malware family:
n/a
Score:
6/10
Tags:
n/a
Behaviour
MalwareBazaar
MeasuringTime
EvasionQueryPerformanceCounter
Verdict:
Suspicious
Threat level:
5/10
Confidence:
100%
Tags:
greyware overlay packed setupapi.dll shdocvw.dll shell32.dll
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Result
Threat name:
MassLogger RAT, Snake Keylogger
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Signature
Allocates memory in foreign processes
Found API chain indicative of sandbox detection
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Snort IDS alert for network traffic
Writes to foreign memory regions
Yara detected Generic Downloader
Yara detected MassLogger RAT
Yara detected Snake Keylogger
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.Lisk
Status:
Malicious
First seen:
2022-10-13 10:44:45 UTC
File Type:
PE (Exe)
Extracted files:
95
AV detection:
18 of 42 (42.86%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Similar samples:
+ 1'997 additional samples on MalwareBazaar
Result
Malware family:
snakekeylogger
Score:
10/10
Tags:
family:snakekeylogger collection keylogger stealer
Behaviour
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Checks computer location settings
Loads dropped DLL
Executes dropped EXE
Snake Keylogger
Snake Keylogger payload
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Unpacked files
SH256 hash:
2008f8142b2c56d607b8a1aee44f01f2dc73f4781c88c69db633e1958558138b
MD5 hash:
7fb11828bd5d8d4d94dcd4305eb95df9
SHA1 hash:
be3b4d4da4d718e8654d23934104b09aafb5ab21
Detections:
snake_keylogger
win_masslogger_w0
SH256 hash:
a45896818b81d79c6e0dfbc92aea89b339167cda75edcc6abf203bf191b3c515
MD5 hash:
b7491dd690ad6fa29076b3273084f919
SHA1 hash:
f09437f837e4263ea4b926ed4404557645b66dce
SH256 hash:
06b02574925948a3f418ba2851f10585086a5f9b25d8f4e7de62dd52c6a56153
MD5 hash:
3ec6a74171c7f6fe3cd9727b7a5907de
SHA1 hash:
ecc3e77b970e198dfe6ab4bdee2fe460e79722cb
Malware family:
SnakeKeylogger
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | pdb_YARAify |
|---|---|
| Author: | @wowabiy314 |
| Description: | PDB |
| Rule name: | sfx_pdb |
|---|---|
| Author: | @razvialex |
| Description: | Detect interesting files containing sfx with pdb paths. |
| Rule name: | sfx_pdb_winrar_restrict |
|---|---|
| Author: | @razvialex |
| Description: | Detect interesting files containing sfx with pdb paths. |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.