MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0d2de03f5c0a63b563c32950a55c57f6dee9cb095da20167784c85f998ecbe83. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0d2de03f5c0a63b563c32950a55c57f6dee9cb095da20167784c85f998ecbe83
SHA3-384 hash: 301c301c0b3e3161e043c9c51c4084f63a6ca651b90d75bb446b27c913ce7333329518906f0e2ac3540dfe347a57a46f
SHA1 hash: 99a9d33eb1b5d59264ed69070469ff39373356bc
MD5 hash: 018ab55d91ed0009eb619f88d06d74f3
humanhash: magazine-maine-juliet-alabama
File name:micc.bin
Download: download sample
Signature MassLogger
Create hunting rule
File size:556'544 bytes
First seen:2020-06-24 08:47:07 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:XsEOFX0O+1nDCq92f5MQw5FDsgys6RTnzSsAjAuYcVW:8Th+F92Hw5p6BzcAuv0
Threatray 672 similar samples on MalwareBazaar
TLSH 5CC44C1AFE95CE10C2585B33C083C41453F98B8256E7EB0FB9E513D219073ABD95FAA6
Reporter JAMESWT_WT
Tags:MassLogger

Intelligence

File Origin
# of uploads :
1
# of downloads :
81
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/13630/
Detection(s):
Win.Dropper.Msilperseus-7772566-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending an HTTP GET request
Using the Windows Management Instrumentation requests
Creating a window
Creating a file in the %temp% subdirectories
Reading Telegram data
Reading critical registry keys
Moving a file to the %temp% subdirectory
Deleting a recently created file
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0d2de03f5c0a63b563c32950a55c57f6dee9cb095da20167784c85f998ecbe83/
Threat name:
ByteCode-MSIL.Trojan.BMassKeyLogger
Create hunting rule
Status:
Malicious
First seen:
2020-06-24 06:29:10 UTC
File Type:
PE (.Net Exe)
Extracted files:
3
AV detection:
40 of 48 (83.33%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=buw6ap24bjr3ky6dffikkxcx63potsyjlwracz3yjsc7tghmx2bq._file
Verdict:
unknown
Similar samples:
045cfe04d64a1c71873d0fb2dbd1a48471f9918b1649b87ef001010dfc2a4286
MassLogger
09fb066f4a5fbc57b4d592a8443151578605c8a573746c3989a79bd1fa28c3a2
MassLogger
1342cdcc9231fdd7637c5a78b07485e5f2fb706479e0441f0b53bd1bd8228697
MassLogger
41df7c7f04b04ac0f2eb88f099c9df36f01e11eaff1c189573f49054758d653d
MassLogger
7601104485381f818f5b171b8be6630c0f6b4792e14695e6146c876ff852cb3c
MassLogger
7fd925382882b58adc1b5e4a24a96d7fdcf3089f9badc5f6190489ddc9cb238a
MassLogger
89c1555df1aec68698da57ff4e65909c72081a3560d59e0ccdc8b150adcdf9f6
MassLogger
c1f47530ee05dd0e8f351afba5b62ff75d331c5bd3b292e2fe14e3db2aaabff4
MassLogger
ec8e1726c79994f38b1137b7652d7e31eea1ac4c9edc32ddb0888bb31b138fed
MassLogger
ff0b197ef34800ad007a5caedaf485af5ae523343ce8ec106d3a253d2c0a4a35
MassLogger
+ 662 additional samples on MalwareBazaar
Result
Malware family:
masslogger
Create hunting rule
Score:
  10/10
Tags:
ransomware spyware stealer family:masslogger
Link:
https://tria.ge/reports/200624-a56qp3bm1s/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Looks up external IP address via web service
Reads user/profile data of web browsers
MassLogger log file
MassLogger
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:masslogger_gcch
Create hunting rule
Author:govcert_ch

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/13630/

Comments