MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0d3054972b35fa5c6f67ba30f1495823dda35917b171af358242c20293e2bbbb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

MassLogger

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	0d3054972b35fa5c6f67ba30f1495823dda35917b171af358242c20293e2bbbb
SHA3-384 hash:	68b348a08069f29db0f401314566f23c9dceeb31efac92abe9a5b4903648f4bd86726f98c39b22e666bd32fc1f7f17cb
SHA1 hash:	6460aed133d60d8cf7a1cebc9eac08d9e0a635e2
MD5 hash:	66883d9f96b49980f2faa93043d00c1d
humanhash:	fish-failed-jig-kilo
File name:	OSE.exe
Download:	download sample
Signature	MassLogger Create hunting rule
File size:	1'047'040 bytes
First seen:	2020-07-10 15:23:35 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	2050fc6fe8629092d6969251a507616c (10 x AgentTesla, 3 x AZORult, 3 x MassLogger)
ssdeep	24576:9iyCa7qmd5pLQyir/N+97sYt2uVDeLStfKtv3VC:9iBPq5adL4BsYt2CjCd3I
Threatray	2'137 similar samples on MalwareBazaar
TLSH	6D25C022F2D14837D1B31A7C4D1F6368BB2ABE512A3C95467BE40C7C9F3A6503939297
Reporter	James_inthe_box
Tags:	exe MassLogger

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Gathering data

Detection(s):

PUA.Win.Adware.Slugin-6803969-0

PUA.Win.Adware.Slugin-6840354-0

SecuriteInfo.com.Trojan.Delf.FareIt.Gen.7.2197.30182.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Launching a process

Creating a file in the %AppData% subdirectories

Creating a process from a recently created file

Using the Windows Management Instrumentation requests

Creating a file

Reading Telegram data

Reading critical registry keys

Moving a recently created file

Deleting a recently created file

Unauthorized injection to a recently created process

Unauthorized injection to a recently created process by context flags manipulation

Setting a global event handler for the keyboard

Unauthorized injection to a system process

Enabling autorun with Startup directory

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/0d3054972b35fa5c6f67ba30f1495823dda35917b171af358242c20293e2bbbb/

Threat name:

Win32.Infostealer.Fareit

Status:

Malicious

First seen:

2020-07-10 12:43:01 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

24 of 27 (88.89%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=buyfjfzlgx5fy33hxiypcskyepo2gwixwfy26nmcilbafe7cxo5q._file

Verdict:

malicious

Label(s):

hawkeyekeylogger

MassLogger

407768d45386b545b588ceb938324586954e446132ecef0273b8067cbf1ce4d9

MassLogger

45e3a9f28c7e79a55264a5c88490dfe51a73639eac96e29f724bdc96232e341b

MassLogger

5de3a91f516ff756b450155641e354aebc48ff4701721dde73ef1960bf955b94

MassLogger

777a3c049f1a80043ae61b63e864cda66494a8c7ee62d96f18d5823ef19ef52d

MassLogger

b7c38b8ca8e90da906c7df9ea379e0c9386780ee32b174cd1f82cd8662822efc

MassLogger

b9e156679af35954a3626be32b8a274dc2067a439b7ff0459cac7bd91aa0e7e5

MassLogger

c9a1e7bfb01b6f8f269a6b04cde83384edaec1d81edf3280d595153e7a148b23

MassLogger

d251c653db7e7df1e0d7858d8e1870055a5ccdd5749295c1a41a1e47f2a3c109

MassLogger

f27eb43c59ea9a9f7ffc4e9bb14e67fd1667825c0e8851d4a1abb9441180076a

MassLogger

+ 2'127 additional samples on MalwareBazaar

Result

Malware family:

masslogger

Score:

10/10

Tags:

stealer spyware family:masslogger

Link:

https://tria.ge/reports/200710-9qmhk5t4fx/

Behaviour

Suspicious behavior: AddClipboardFormatListener

NTFS ADS

Suspicious use of WriteProcessMemory

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetThreadContext

Looks up external IP address via web service

Reads user/profile data of web browsers

Loads dropped DLL

Drops startup file

Executes dropped EXE

UPX packed file

MassLogger log file

MassLogger

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.