MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1c2f10aaf4e8b9a9e90316e8b470616bac893609cd85374cb11bb4a1a3971e5b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

MassLogger

Vendor detections: 5

Intelligence 5 IOCs YARA 1 File information Comments

SHA256 hash:	1c2f10aaf4e8b9a9e90316e8b470616bac893609cd85374cb11bb4a1a3971e5b
SHA3-384 hash:	9441069b78ed06b0483d46fbf62ac940fa5fc037182c9d3ac6645cd70b9091c389b9bf300e721572c252e9de0d9d7d41
SHA1 hash:	fd7d1e1c6b49b97db475ccc56958bee3964ad766
MD5 hash:	3e414d89b9f98f4cc6c5988634791c0a
humanhash:	maryland-ten-cold-solar
File name:	Sales note PO53.exe
Download:	download sample
Signature	MassLogger Create hunting rule
File size:	882'176 bytes
First seen:	2020-07-09 07:40:25 UTC
Last seen:	2020-07-09 18:31:12 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'461 x Formbook, 12'202 x SnakeKeylogger)
ssdeep	12288:3ETOJGR7jx90xO+IN17q3gCIi0juzJ/dYK/jX6zdPTawFv34NKSaKFacTaulCSR+:s90rgnjuzJjX6zdXINZaQLTESR6Z
Threatray	2'305 similar samples on MalwareBazaar
TLSH	3A15F1B73D492E77DB380ABF140250049FA0498B42EAE6CA3C4DE2DA7DF6F955D015A3
Reporter	abuse_ch
Tags:	exe MassLogger

abuse_ch

Malspam distributing MassLogger:

HELO: ganadorme.com
Sending IP: 185.118.166.142
From: procurement2@ganadorme.com
Subject: Ganadorme Products Order
Attachment: Sales note PO53.zip (contains "Sales note PO53.exe")

MassLogger SMTP exfil server:
smtp.yandex.ru:587

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/23527/

Detection(s):

SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Unauthorized injection to a recently created process

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/1c2f10aaf4e8b9a9e90316e8b470616bac893609cd85374cb11bb4a1a3971e5b/

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2020-07-09 02:46:21 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

23 of 29 (79.31%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=dqxrbkxu5c42t2idc3uli4dbnowisnqjzwctotfrdo2kdi4xdznq._file

Verdict:

unknown

MassLogger

3ca89270a1e4ae27056087ab556bdadd89ba1ab27b505afa53a812c5f2acabc8

MassLogger

4ff6913b35226527d4bb0bd458d326ad3d1bdd50b90aaac6d4eae1f7f43922c1

MassLogger

51e016d7614461f51389151f4dce30de7db0945f781b4d7d6ec6ab1ef97935fa

MassLogger

775cbf86bee09ee9b8024f2d8da2ce47cbfc29d2a907df7387bc87fbfae40dcd

MassLogger

7d3068aff051388b3332905ca9a26a10a1cd96441e3be9d908cd839088cc9d65

MassLogger

80f41a09d12356205262bb77b16daeaf2a284a89fd737b042149a4207f16c702

MassLogger

b3f42f7a9747edcd9d13cab3d0a41b3e0d3cde5a5548f5328b5fcf2f3e068d85

MassLogger

b5cc8b2d62e6c2d6a9bf080c4c41e19295af7dae7230a63b7f6ad8def08e7ea2

MassLogger

c4031838bc163076ff2845546cad4c409d9cec8a2100d78d4ea1ea75579f7c37

MassLogger

+ 2'295 additional samples on MalwareBazaar

Result

Malware family:

masslogger

Score:

10/10

Tags:

spyware stealer family:masslogger

Link:

https://tria.ge/reports/200709-wfe6aczw2n/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetThreadContext

Looks up external IP address via web service

Reads user/profile data of web browsers

MassLogger log file

MassLogger

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.