MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 14a6d8b3111df647667bfe418bfd55354a13e1b7b3f69e229d9495dc6fd6ab34. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 6


Intelligence 6 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 14a6d8b3111df647667bfe418bfd55354a13e1b7b3f69e229d9495dc6fd6ab34
SHA3-384 hash: 4fb10de075f1439276e8c7d39729fdd80c55d1939e1929209799b742eaaab40dfbd3d31391cdbcee7f0009a4894fd1f8
SHA1 hash: 8d24213b5d5a9256822882579b8e31697e8e8c2d
MD5 hash: 29c4e4ad7504651cf1b82d2e5f6f3916
humanhash: indigo-purple-winner-iowa
File name:Proforma invoice.exe
Download: download sample
Signature MassLogger
Create hunting rule
File size:1'063'936 bytes
First seen:2020-08-06 05:05:49 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 24576:Hvty+4mQ7KUA3Awy8B+tsy1XWqogYLRQAV:Pty+PQNEAwy8YtsyJWqYLR
Threatray 767 similar samples on MalwareBazaar
TLSH 6435E00A716C478DF9A04B7000FEA24B2B6CED2AFA12D55D4A73FCA61731B015DD2F69
Reporter abuse_ch
Tags:exe MailChannels MassLogger


Avatar
abuse_ch
Malspam distributing MassLogger:

HELO: dog.birch.relay.mailchannels.net
Sending IP: 23.83.209.48
From: market@newamstar.com
Subject: PROFORMA INVOICE
Attachment: Proforma invoice.xz (contains "Proforma invoice.exe")

MassLogger SMTP exfil server:
mail.sbrenind.com:26

Intelligence

File Origin
# of uploads :
1
# of downloads :
74
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/39999/
Detection(s):
SecuriteInfo.com.Generic.mg.29c4e4ad7504651c.23323.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Creating a file in the %AppData% directory
Creating a file in the %temp% directory
Launching a process
Creating a process with a hidden window
Deleting a recently created file
Unauthorized injection to a recently created process
Creating a file
DNS request
Sending an HTTP GET request
Using the Windows Management Instrumentation requests
Enabling autorun by creating a file
Result
Threat name:
MassLogger RAT
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/412037
Signature
Found malware configuration
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
May check the online IP address of the machine
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sigma detected: Scheduled temp file as task from temp location
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to steal Mail credentials (via file access)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected MassLogger RAT
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/14a6d8b3111df647667bfe418bfd55354a13e1b7b3f69e229d9495dc6fd6ab34/
Threat name:
ByteCode-MSIL.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2020-08-06 05:07:07 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=cstnrmyrdx3eozt37zayx7kvgvfbhynxwp3j4iu5ssk5y36wvm2a._file
Verdict:
unknown
Similar samples:
1ae9562563888e54d90d5a869caaa7c81213273467a71c28fb50349cf967741e
MassLogger
7cfa62ab7a592f04b4268ad35e2a90739666f9d5e91eaa5808dd8ba11239f43d
MassLogger
978d501d754314e4e9fb7d64e455a83407321b2410ac0682181d978f8973bf56
MassLogger
a4df7bd8daff5a4723055c7589244e1719c45223f09f42b06a621aad5ee1f2f4
MassLogger
a990373e6225384bd1bab3441dc0cb881f1e03f51f83f7923ca6c9ff228bee5c
MassLogger
bbf5829871a9c0e6348a4cbab3327df93fd5196b611afafef770cf85e85bfd6c
MassLogger
dc05645067f3f3ccf6a4e647dcf935c928fd981ef904672603a7ab409488166e
MassLogger
ebcea3b90af00f67983ebb15abec7e46a480818904a74764aab402da08d7b16b
MassLogger
ec2433fe91061cb731a1828ed41897b005983b5b5092ffe561e76b217c12cef8
MassLogger
fc9d50ccd0d0a267f1fa1003607ea81931a9c1f857798c3b10af9b5408f01437
MassLogger
+ 757 additional samples on MalwareBazaar
Result
Malware family:
masslogger
Create hunting rule
Score:
  10/10
Tags:
ransomware spyware stealer family:masslogger
Link:
https://tria.ge/reports/200806-8hld88vkde/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Creates scheduled task(s)
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: AddClipboardFormatListener
Creates scheduled task(s)
Suspicious use of WriteProcessMemory
Suspicious use of SetWindowsHookEx
Suspicious use of SetThreadContext
Looks up external IP address via web service
Reads user/profile data of web browsers
MassLogger
MassLogger log file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.45
Link:
https://yomi.yoroi.company/submissions/14a6d8b3111df647667bfe418bfd55354a13e1b7b3f69e229d9495dc6fd6ab34

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:masslogger_gcch
Create hunting rule
Author:govcert_ch
Rule name:win_masslogger_w0
Create hunting rule
Author:govcert_ch

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

zip a2732b21dd81ef941e466656fe2f9e424abdfcd4dc1bf9798014adc5916c47a4

MassLogger

Executable exe 14a6d8b3111df647667bfe418bfd55354a13e1b7b3f69e229d9495dc6fd6ab34

(this sample)

  
Dropped by
MD5 3fc463023102b74cf08dcc04af1b358e
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/39999/
  
Dropped by
SHA256 a2732b21dd81ef941e466656fe2f9e424abdfcd4dc1bf9798014adc5916c47a4

Comments