MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0bf96baeec569010dc7acb82cd5f2bb7feacd9c5411dcd6d8fd53c9b316344ce. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

MassLogger

Vendor detections: 4

Intelligence 4 IOCs YARA 1 File information Comments

SHA256 hash:	0bf96baeec569010dc7acb82cd5f2bb7feacd9c5411dcd6d8fd53c9b316344ce
SHA3-384 hash:	71cce96d1e858191f74192ab7d7b603504883804ab114ab0cf70ed9d1bdb15bbcc5b455ccf9325a820a54818eff5eb53
SHA1 hash:	56b7e0e9918c0d12bc21c255bdba57e8fe7ae18c
MD5 hash:	41eeb21fde2e0191d466f6ac5f75b4b3
humanhash:	august-triple-potato-charlie
File name:	Invio Estratto.exe
Download:	download sample
Signature	MassLogger Create hunting rule
File size:	863'232 bytes
First seen:	2020-05-22 10:08:34 UTC
Last seen:	2020-05-22 10:51:47 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep	24576:ymw9XPMqu7hohn4lg3bY0V+oSL259NOj:y3/c7wel0coSL2e
Threatray	659 similar samples on MalwareBazaar
TLSH	0A05F116538D156BEE9CC2BBC0D265040AF1906E219BE79DECB194EE8B0F7B3C98514F
Reporter	abuse_ch
Tags:	exe MassLogger

abuse_ch

Malspam distributing MassLogger:

HELO: cloudhost-143971.us-west-1.nxcli.net
Sending IP: 173.249.144.86
From: GLS BARI <bari@gls-italy.com>
Subject: Invio Estratto Conto
Attachment: Invio Estratto.CAB (contains "Invio Estratto.exe")

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.MSIL.Kryptik.UCB.22051.UNOFFICIAL

Gathering data

Threat name:

ByteCode-MSIL.Trojan.Kryptik

Status:

Malicious

First seen:

2020-05-22 10:36:45 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

18 of 30 (60.00%)

Threat level:

2/5

Verdict:

malicious

MassLogger

285623e11160e11e97e3871ae86f412e561dcc0a1f90b498e6897c27378b36bc

MassLogger

5756414989427044652d411548d7523b88c74449101d277d0b227a00c8526bc3

MassLogger

6033acde8c4bde98b22ad4e45db8bc34123e794019b42750a3430ba97e33c804

MassLogger

828b44ee0da00ddfc797dc86f74153b773bef7673f798af3e603148ca0399b35

MassLogger

82d687b835b9cd13408495c0e3979aad732f6dee11fcfddff3d1921af22fc9e0

MassLogger

a2854a29cb5800a8837404fd4333fe055b929b6e772f8bcb911907d5638e8777

MassLogger

bc45113b5ca48cd246e8b3f5a1f57a43ec38d5959e430998ee83563a6ff6a77f

MassLogger

c75eff508f62cf4acb9960a32a93e15f4037325a66b8b669649c83d08ee70730

MassLogger

d8e9cd82c50df73b2859bb79d45585cd651783541f20badac4d9fc64aefb2820

MassLogger

+ 649 additional samples on MalwareBazaar

Result

Malware family:

masslogger

Score:

10/10

Tags:

family:masslogger ransomware spyware stealer

Link:

https://tria.ge/reports/201109-a57sn6w8v2/

Behaviour

Suspicious behavior: AddClipboardFormatListener

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Looks up external IP address via web service

Maps connected drives based on registry

Reads user/profile data of web browsers

MassLogger

MassLogger log file

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.