MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1934bdf522d76039b24a8e28c4749d5f2f111b5c4b63af53804fafae495f1864. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

MassLogger

Vendor detections: 5

Intelligence 5 IOCs YARA 1 File information Comments

SHA256 hash:	1934bdf522d76039b24a8e28c4749d5f2f111b5c4b63af53804fafae495f1864
SHA3-384 hash:	fb71e727b7c5809f4cdbf5577592418723e174f815d6478e0c86276948b78dd6b79440ad80f343680f02ae811df6f45a
SHA1 hash:	f695dffdf269f3ae5a72ce713e7930020f60734f
MD5 hash:	6a22be01906d153bad9960303f5022b2
humanhash:	sixteen-connecticut-pasta-one
File name:	Catalogue RMK Trading 0807202-07_PDF.exe
Download:	download sample
Signature	MassLogger Create hunting rule
File size:	1'192'448 bytes
First seen:	2020-07-09 07:29:29 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep	24576:z3FxJYIuGWl2toemIHvSPxe3wPAVOyCLTESR8dX:TmIuGW8toeOg/BCLwSOdX
Threatray	1'838 similar samples on MalwareBazaar
TLSH	C3450238B7D48D16D73A4F36887200008F74FA6B9957F3AF9DC8259E689F7880912B57
Reporter	abuse_ch
Tags:	exe MassLogger

abuse_ch

Malspam distributing MassLogger:

HELO: server.sattisfarm.community
Sending IP: 162.241.205.6
From: RMK Trading Ltd <info@sattisfarm.community>
Subject: INQUIRY
Attachment: Catalogue RMK Trading 0807202-07_PDF.iso (contains "Catalogue RMK Trading 0807202-07_PDF.exe")

MassLogger SMTP exfil server:
smtp.yandex.ru:587

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Gathering data

Detection(s):

SecuriteInfo.com.Trojan.PackedNET.378.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/1934bdf522d76039b24a8e28c4749d5f2f111b5c4b63af53804fafae495f1864/

Threat name:

ByteCode-MSIL.Trojan.Kryptik

Status:

Malicious

First seen:

2020-07-09 07:31:07 UTC

AV detection:

22 of 27 (81.48%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=de2l35jc25qdtmskryumi5e5l4xrcg24jnr26u4aj6x24sk7dbsa._file

Verdict:

malicious

MassLogger

21ae6a2cb858073f8ef1089c949f36fd890f79a9b5f2385f945b1bc7a8a4da76

MassLogger

3315958fc5d16e16e78d1c4023a797b38b1246552ca148255bfd0124cec0c771

MassLogger

46200359aaf042b4f42a8ee7b23b1b573013d80e7335ac8fb5c870dfdd9f02d7

MassLogger

7c19cbbbb385a448d0033fe89cf139fff95ea9760ac2f0e9fa9acac60d180b81

MassLogger

a485d30d6c6bb72943cce9397693d1246e58b468674848c8c59e75a238b2515e

MassLogger

af078dd29518dff5e63761879d05deff52166e3d925575082b27eff2c531c518

MassLogger

bec49428d91505adca491651a2376e3d90e33091dad7c2b63a7db472d2a28e57

MassLogger

c8bfc4f69bf05fb34da25259cf0fe100b8311b8500c2cac5d4e08063698c291f

MassLogger

e4efbdcde8db7352bdf2cb15677d4dea605e29e8fbcaf77f4aa0bd4d6a089117

MassLogger

+ 1'828 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/200709-gbx394awhs/

Behaviour

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Program crash

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.