MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 131bfb49b5d80492ddcab3ec34448a445806e0c992c96eca65d42311539defe6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

MassLogger

Vendor detections: 4

Intelligence 4 IOCs YARA 1 File information Comments

SHA256 hash:	131bfb49b5d80492ddcab3ec34448a445806e0c992c96eca65d42311539defe6
SHA3-384 hash:	dc5f3efb627b08cfe61096737878ed6d171ad6f2cea14874c9ca655a634b350b8b3716354eba2156777f8f12a0c0860f
SHA1 hash:	d912b907f5118a3f97ccd24a35edfc42e1dbec3c
MD5 hash:	fd273584ac0fade9565d581100890e10
humanhash:	failed-winner-mexico-fillet
File name:	ORDER CONFIRMATION .exe
Download:	download sample
Signature	MassLogger Create hunting rule
File size:	747'008 bytes
First seen:	2020-06-24 05:47:38 UTC
Last seen:	2020-06-25 12:57:28 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep	12288:shNMfw5dbadb8OMGETUFqVGoNOFtQjz55xqtSvSezi7bKFJf93TBjv1sigw:GNHdAb8ZnUFq3O8jjxq+g7bKTfHT18w
Threatray	857 similar samples on MalwareBazaar
TLSH	64F4121B3B9CF627C53908F8DCD05B0453B61AABA191FAED7C8099D929D37F40A216C7
Reporter	abuse_ch
Tags:	exe MassLogger

abuse_ch

Malspam distributing MassLogger:

HELO: damen.com
Sending IP: 37.49.224.211
From: Steven Ravestein <steven.ravestein@damen.com>
Reply-To: Steven Ravestein <steven.ravestein@damen.com>
Subject: RE: ORDER CONFIRMATION
Attachment: ORDER CONFIRMATION.rar (contains "ORDER CONFIRMATION .exe")

MassLogger SMTP exfil server:
mail.privateemail.com:587

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/13429/

Detection(s):

SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/131bfb49b5d80492ddcab3ec34448a445806e0c992c96eca65d42311539defe6/

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2020-06-24 05:49:07 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

25 of 29 (86.21%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=cmn7wsnv3acjfxokwpwdirekirmanygjslew5stf2qrrcu4557ta._file

Verdict:

unknown

MassLogger

1fa1363c857cc46f603a4eff38b86058b80ecca1f554c65e943f94725b5c2570

MassLogger

5d7470dd39f59feeb354918508f99d909e2e05a9bd41e4a180848f999cd00fb3

MassLogger

76933bfe9afdf8d266352155f09995acadcab23345fabe2518d5bf15d45c9cd4

MassLogger

7d56a78ec4597281ff8c36645c1ff7286cf3d494965a2acd6666ece2d8ff856b

MassLogger

851f1641fb283113cc5feb03c807bc82dc4d85ecd22ab8ff091a8edd71bb45ed

MassLogger

c38c88878a7c284cd19149b2efb91129b16ae51c6ff32badb2622122185f1692

MassLogger

c8174141c60baa057aa9780fdb5fe1e4af59b9d3a9d5a1d8ab7d929b13d3882b

MassLogger

f0176393025bb51cbf9ac3e0d457ab89e129d90583fa103ff9db794687787715

MassLogger

f302282c8f607b9b5225217fa0c83e843057b8e69097d36c0c70f9e8c533697e

MassLogger

+ 847 additional samples on MalwareBazaar

Result

Malware family:

masslogger

Score:

10/10

Tags:

ransomware spyware stealer family:masslogger

Link:

https://tria.ge/reports/200624-sq4q1m3gme/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: AddClipboardFormatListener

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Creates scheduled task(s)

Suspicious use of SetThreadContext

Looks up external IP address via web service

Reads user/profile data of web browsers

MassLogger log file

MassLogger

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.