MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 0e8c4ea04759257bb250d60f1a3b1988888044fd06ce2f9fccef81b047eee4bc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
MassLogger
Vendor detections: 6
| SHA256 hash: | 0e8c4ea04759257bb250d60f1a3b1988888044fd06ce2f9fccef81b047eee4bc |
|---|---|
| SHA3-384 hash: | 287779ed77baa41fb39f8de42c5b5996cb568da5f07e4b7a87d62fef45e80b95c710cba016a4ebfd6d84a7fb614230d5 |
| SHA1 hash: | 43e20a6ec83da77bb088f239789a7706cdf25d32 |
| MD5 hash: | 6e8c79af60ee5864468cb27b179cc470 |
| humanhash: | connecticut-minnesota-sixteen-twenty |
| File name: | swift.exe |
| Download: | download sample |
| Signature | MassLogger |
| File size: | 1'239'040 bytes |
| First seen: | 2020-08-18 06:18:15 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 639357242ed279ceaa4726408d2cc6d5 (10 x AgentTesla, 4 x Formbook, 3 x MassLogger) |
| ssdeep | 24576:kF7OuHzkK4d7403c8Un2RTq0tGet1U7WNKroawv1oEL:kFy+f8nc8UnVv7UQoawWEL |
| Threatray | 531 similar samples on MalwareBazaar |
| TLSH | F645C022A1E04836D1B229784C3F7AB8983BBF1039FC55477BE47D089F3A6513565E87 |
| Reporter |  abuse_ch |
| Tags: | exe MassLogger |
abuse_ch
Malspam distributing unidentified malware:HELO: mail-cld-x17.trdns.com
Sending IP: 77.245.145.67
From: Account Payable <info@doseglobalservices.com>
Subject: Swift Confirmation
Attachment: swift.r00 (contains "swift.exe")
Intelligence
File Origin
# of uploads :
1
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Detection(s):
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Launching a process
Unauthorized injection to a recently created process
Sending a UDP request
Using the Windows Management Instrumentation requests
Running batch commands
Creating a file
Unauthorized injection to a system process
Enabling autorun by creating a file
Deleting of the original file
Threat name:
Win32.Trojan.LokiBot
Status:
Malicious
First seen:
2020-08-17 09:01:16 UTC
AV detection:
26 of 29 (89.66%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
hawkeyekeylogger
Similar samples:
+ 521 additional samples on MalwareBazaar
Result
Malware family:
masslogger
Score:
10/10
Tags:
ransomware upx spyware stealer family:masslogger
Behaviour
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Looks up external IP address via web service
Drops startup file
Reads user/profile data of web browsers
UPX packed file
MassLogger
MassLogger log file
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.