MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0b46380a79a72d6029ee1437d2b2c7c542a33dbba00a73172e8917fa902c035e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

MassLogger

Vendor detections: 5

Intelligence 5 IOCs YARA 1 File information Comments

SHA256 hash:	0b46380a79a72d6029ee1437d2b2c7c542a33dbba00a73172e8917fa902c035e
SHA3-384 hash:	1ec777ddceaa560fb1c053394660698b3f7c2da3589658bc09f49ec2126dc62e0883f6fefd3defc5614d764227058149
SHA1 hash:	835727fa9c8236fe5fe8ac6c0e4f3aa15dc21ded
MD5 hash:	3b79245c658148c069ee54f7d3d96407
humanhash:	vermont-massachusetts-oven-papa
File name:	tony.exe
Download:	download sample
Signature	MassLogger Create hunting rule
File size:	697'344 bytes
First seen:	2020-06-03 09:02:07 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep	12288:5zD8ZRPMGVSsAjAuYcVWSMDMVqfBdcmDBQPW5R/ZsGBL:5zgZVcAuv0dMVqJdcw59qGB
Threatray	433 similar samples on MalwareBazaar
TLSH	F4E4BEEA21D18F04C279783BC371835006F297041673E769ED7B42E32E63B78BA665D9
Reporter	abuse_ch
Tags:	exe MassLogger

abuse_ch

Malspam distributing MassLogger:

HELO: joister.net
Sending IP: 103.2.236.240
From: Mrs. Olivia Freund <Sales@metroco.org>
Reply-To: Sales@metroco.org
Subject: New Purchase Order
Attachment: New Purchase Order.zip (contains "tony.exe")

MassLogger SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Gathering data

Threat name:

ByteCode-MSIL.Trojan.Crysan

Status:

Malicious

First seen:

2020-06-04 01:05:22 UTC

AV detection:

20 of 31 (64.52%)

Threat level:

2/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=bnddqctzu4wwakpocq35fmwhyvbkgpn3uafhgfzorel7vebmanpa._file

Verdict:

malicious

MassLogger

47e006890226bdff31e019f7dbf9f0edc1c46385504186a3819be57cb41d6c2a

MassLogger

5d23c0113f6b67689ba81bb35056cc530d8ccd6c393f26def4103e9b69d110e2

MassLogger

64a0f19845c2724ec1e75467da1f1cab42ef3a78914171af40a0c4c8f798a9fd

MassLogger

ac3f17465c64d5add698c45aae799dc9d0f7232959c0844e4e6c722c036379c8

MassLogger

bd72223afa837379fe320c88e0c18d6bffaa463615b4d68c1afbfd3bac4f5f93

MassLogger

c4daccf0ac446a6160b18ea3fbf9ab3166ee4181c0e9a40d1c7f26702dea5a69

MassLogger

d57f6bfd820c84a664edfa6d70259bf8d29763297a33e26557d0c553acd9d22e

MassLogger

ed02a2653566d5a67a9b1863d02ed672b1947a6566cc61464f0d7a24ea335074

MassLogger

f6853a25abff371818a7a5852ecaf8b01482577e3f2a4eb1ca2093b739d1601c

MassLogger

+ 423 additional samples on MalwareBazaar

Result

Malware family:

masslogger

Score:

10/10

Tags:

family:masslogger ransomware spyware stealer

Link:

https://tria.ge/reports/201109-k3hdj4qz3n/

Behaviour

Suspicious behavior: AddClipboardFormatListener

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Looks up external IP address via web service

Checks computer location settings

Reads user/profile data of web browsers

MassLogger

MassLogger log file

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.