MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 13dd79b77c2ed2ba77d509e2d3b4621e83f7105674353f7e30930e07b099bce5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 5


Intelligence 5 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 13dd79b77c2ed2ba77d509e2d3b4621e83f7105674353f7e30930e07b099bce5
SHA3-384 hash: 56122859df71c4516f07eaac59815f5f96d666f516e3a66efa90a081604d44340dfd401fd1400edfabb2af3ba2678d2f
SHA1 hash: 06d5be5ef404c61a41d15bab8351aed6fb9ab310
MD5 hash: 9906e3d9a42e2053405b72c9f85b0bad
humanhash: edward-gee-delta-ten
File name:kmd.exe
Download: download sample
Signature MassLogger
Create hunting rule
File size:1'890'304 bytes
First seen:2020-07-09 17:57:11 UTC
Last seen:2020-07-09 18:35:19 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash e17ecf06dcc92936aee2048221f12a95 (2 x AgentTesla, 1 x MassLogger)
ssdeep 49152:oKdg3KptXGifrH4wbARKxSvqWbuiHbnFlpoA7utkF:oCptXGifrYwVxSvqWbHHbnuA7KkF
Threatray 1'302 similar samples on MalwareBazaar
TLSH 5C952352D10224E9F0983D70871FEEF64A976022AE2A7B260D05F81D79B60DCF6F9653
Reporter cocaman
Tags:exe MassLogger

Intelligence

File Origin
# of uploads :
2
# of downloads :
89
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Detection(s):
PUA.Win.Packer.Upx-49
Create hunting rule

PUA.Win.Packer.UpxProtector-1
Create hunting rule

PUA.Win.Packer.Upolyx-12
Create hunting rule

PUA.Win.Packer.Upx-6
Create hunting rule

PUA.Win.Packer.Upx-4
Create hunting rule

Sanesecurity.Rogue.0hr.20200709-1706.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Creating a file in the %temp% subdirectories
Using the Windows Management Instrumentation requests
Reading Telegram data
Moving a file to the %temp% subdirectory
Reading critical registry keys
DNS request
Sending a custom TCP request
Creating a file in the Windows subdirectories
Sending an HTTP GET request
Deleting a recently created file
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/13dd79b77c2ed2ba77d509e2d3b4621e83f7105674353f7e30930e07b099bce5/
Threat name:
Win32.Trojan.LokiBot
Create hunting rule
Status:
Malicious
First seen:
2020-07-09 17:59:04 UTC
File Type:
PE (Exe)
Extracted files:
89
AV detection:
24 of 28 (85.71%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=cpoxtn34f3jlu56vbhrnhndcd2b7oecwoq2t67rqsmhapmezxtsq._file
Verdict:
malicious
Label(s):
hawkeyekeylogger
Create hunting rule
Similar samples:
31e0d8d290cef40450e8afb88a58749155645f4f702bdec51a81290d0230de09
MassLogger
3c2d8f447c9bf0c0f88addeed6865b86fd1927c23c71dd551251704813f42a23
MassLogger
9836dae82868c0e7f17114f7fe63e0f5b94f8e99e0c597f43ae12a365458ff69
MassLogger
c905064bb651ad48f6a67415f4b982254e6f816ff03b1f19d3da32da19a8d788
MassLogger
cc71aaff5556a4053df2846a191ff63e54b3b10df75b98a3d8d5edc4c02c7d1b
MassLogger
df6e5a970596d544e6f644924cafadda5a596e2337621ea98829bd36801fa02c
MassLogger
e0cea593cef95fc3438ec707ef6d293c3189c3a3144a389f790cccfaec770759
MassLogger
ecf0a8a19a7ac332b6443616cab0109078c01d6d202a2eae337486e2fc388414
MassLogger
f316c85b920176e192357ff4b735f6d1b99fd7af2f23e24b80e3aef4fd2522ba
MassLogger
f937bbe27c6d52452a121bc9aa320c26ae7eada7cadc9dda0fafc2c6b1bd5818
MassLogger
+ 1'292 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://tria.ge/reports/200709-9kr83j7cl2/
Behaviour
UPX packed file
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:masslogger_gcch
Create hunting rule
Author:govcert_ch
Rule name:suspicious_packer_section
Create hunting rule
Author:@j0sm1
Description:The packer/protector section names/keywords
Reference:http://www.hexacorn.com/blog/2012/10/14/random-stats-from-1-2m-samples-pe-section-names/
Rule name:with_sqlite
Create hunting rule
Author:Julian J. Gonzalez <info@seguridadparatodos.es>
Description:Rule to detect the presence of SQLite data in raw image
Reference:http://www.st2labs.com

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

xz 8a32f65c4461c40f8f0f641c57c4fc7bec585dfc674138025c581079f1e5b7fe

MassLogger

Executable exe 13dd79b77c2ed2ba77d509e2d3b4621e83f7105674353f7e30930e07b099bce5

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 8a32f65c4461c40f8f0f641c57c4fc7bec585dfc674138025c581079f1e5b7fe
Cape
Cape
https://www.capesandbox.com/analysis/24047/

Comments