MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 083c70afde1be48426ebcf28eacfa0cd47f96130790b79f5a367ae6b00eab142. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

MassLogger

Vendor detections: 5

Intelligence 5 IOCs YARA 1 File information Comments

SHA256 hash:	083c70afde1be48426ebcf28eacfa0cd47f96130790b79f5a367ae6b00eab142
SHA3-384 hash:	d4060d9df157831b019e52e5c1838e6f559cfd1fa2236641016ed7649cd7add4ded3169ebf7e1019a63a1d842ea04acb
SHA1 hash:	5a545c6edf90ccedea8387d8f5040f97b9e68bbe
MD5 hash:	75de41ae05708e3574b8e734996eb88f
humanhash:	foxtrot-illinois-bakerloo-blue
File name:	Tech7 A S Profile.exe
Download:	download sample
Signature	MassLogger Create hunting rule
File size:	1'003'520 bytes
First seen:	2020-06-11 06:31:34 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'650 x AgentTesla, 19'462 x Formbook, 12'203 x SnakeKeylogger)
ssdeep	24576:uhJw9c6p59hCWKs4PIKQh3HY+Dh256U0F99U2lmejNezX4hzx2BR3:uEc6p59hC84Poh3H7DXU0fC2lxjNU4ht
Threatray	3'722 similar samples on MalwareBazaar
TLSH	AD25F11076D1AE4EC23E8EB6449728109BB0A4677F17F3835CCB15DA646DF8A0A50F9F
Reporter	abuse_ch
Tags:	exe MassLogger

abuse_ch

Malspam distributing MassLogger:

HELO: tech7automation.com
Sending IP: 37.49.224.135
From: SOURAV GUPTA <purchase2@tech7automation.com>
Subject: Quotation Required on Top Urgent Basis for Supply of Commercial & Industrial Goods
Attachment: Tech7 A S Profile.rar (contains "Tech7 A S Profile.exe")

MassLogger SMTP exfil server:
mail.privateemail.com:587

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/8944/

Gathering data

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2020-06-11 06:33:06 UTC

AV detection:

24 of 31 (77.42%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=ba6hbl66dpsiijxlz4uovt5azvd7syjqpefxt5ndm6xgwahkwfba._file

Verdict:

malicious

MassLogger

235177d9fad8eb7644e4c8e8d98eab92a4b0389c55605793ba5e28abd6f9a6d4

MassLogger

2a9ff7b8ca6a12f714779ecdcd2d86ccf9ad03da04de4a45aa8c3c97b7209c8f

MassLogger

5e110b46db054e7b3b2e12592791e89e76d8baf65c215c1a577ec2016c3c81e5

MassLogger

60da286e39c0c6dcee0d9daafbf5c6662b818c9a36b77d8ba5f4314e94d9baea

MassLogger

872e06d165968c0548d362d26c3c05ba9c3f35fe1066c5623dded0dd7cbb92f2

MassLogger

950d32041bd422de6e75703707b17e94f27235d3632387f02d21160c71d2735e

MassLogger

9b5b44ded4ede28d92834c4db286780a5628d02597a739ff3633f808d47f0939

MassLogger

c39d2b521f5ad659826516372c61ccaa1bb588b2d7e05bc66fb069fb83feb4f7

MassLogger

ec17348438d8e6c04f18e329968d37c5d1be05148a7b770e926b8ebeca75f06e

MassLogger

+ 3'712 additional samples on MalwareBazaar

Result

Malware family:

masslogger

Score:

10/10

Tags:

family:masslogger ransomware rezer0 spyware stealer

Link:

https://tria.ge/reports/201109-qpngzkkhr6/

Behaviour

Creates scheduled task(s)

Suspicious behavior: AddClipboardFormatListener

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Looks up external IP address via web service

Checks computer location settings

Reads user/profile data of web browsers

rezer0

MassLogger

MassLogger Main Payload

MassLogger log file

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.