MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 22d10edc3d0457dd81ee6cd9353e76b3208f8a549c290b80dea1efbbbe120c0b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

MassLogger

Vendor detections: 5

Intelligence 5 IOCs YARA 1 File information Comments

SHA256 hash:	22d10edc3d0457dd81ee6cd9353e76b3208f8a549c290b80dea1efbbbe120c0b
SHA3-384 hash:	0e8595ee7063e87858597bf7bd8d5bcde778a26f15d72180ef96b48879f20266d75d331641a242dfc627c72def7ad1af
SHA1 hash:	6d0878ae4973f39cf0e61b6f5ddd662866435ae7
MD5 hash:	ada080e31c56a4d65a2e426890504121
humanhash:	montana-berlin-freddie-magnesium
File name:	EU Business Register.exe
Download:	download sample
Signature	MassLogger Create hunting rule
File size:	2'003'456 bytes
First seen:	2020-06-16 12:59:01 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	afcdf79be1557326c854b6e20cb900a7 (1'102 x FormBook, 936 x AgentTesla, 399 x RemcosRAT)
ssdeep	49152:bh+ZkldoPK8Yau+VeVr/ETVuI62hzyxQLQ:E2cPK8nUVuYsmyL
Threatray	1'330 similar samples on MalwareBazaar
TLSH	EA95E0027395C036FFABA1739B69F20156BD7D290133852F13982DB9BDB01B1267E663
Reporter	abuse_ch
Tags:	exe MassLogger

abuse_ch

Malspam distributing MassLogger:

HELO: ebr-registry.com
Sending IP: 103.226.248.192
From: register@ebr-registry.com
Subject: EU Business Register 2020/2021
Attachment: EU Business Register.CAB (contains "EU Business Register.exe")

MassLogger SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/10998/

Detection(s):

Sanesecurity.Malware.27686.AidExe.UNOFFICIAL

SecuriteInfo.com.AIT.Trojan.Nymeria.1583.UNOFFICIAL

Gathering data

Threat name:

Win32.Trojan.Tiggre

Status:

Malicious

First seen:

2020-06-16 13:00:11 UTC

AV detection:

26 of 31 (83.87%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=eliq5xb5arl53apontmtkptwwmqi7csutquqxag6uhx3xpqsbqfq._file

Verdict:

malicious

MassLogger

3027dc21e325fddbc9e6cd21b0491f3270190f219776de4971e510c4490d3c25

MassLogger

44a169140fbd4a243478d8504cb62dd7a5d2225df55d058c4aa71dd0c0d7c480

MassLogger

4dfa820d0e37418dbd81c9c217608dac6dc1b59391c0e49839662f522edd26a1

MassLogger

5d1e3dde61df9647adda8f315a818eee234ce948c89e8083060d84801dff15c1

MassLogger

7b6cb4a94f2899f6363bbaeab018125a20310d9ad1d22b121d004803914fb378

MassLogger

8185bd02c507e6433d03c12e5f8b94b574d2f2ebb597e766563fd28295b5d681

MassLogger

b08e304100c6e1218210e6be2b006a4d2231ea9dcf6f0c55832362797d4ff21c

MassLogger

b51612fb244526a66524e234ccae2d57f1c98a37080fd94664626bcdcf6c4bbb

MassLogger

dde62265df0b255aa06ac36fe0ac09ba40c87a92c4d29d4b823227c68a29e869

MassLogger

+ 1'320 additional samples on MalwareBazaar

Result

Malware family:

masslogger

Score:

10/10

Tags:

ransomware spyware stealer family:masslogger

Link:

https://tria.ge/reports/200624-97bz5lvdqe/

Behaviour

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Suspicious behavior: AddClipboardFormatListener

Suspicious use of SetThreadContext

Looks up external IP address via web service

Reads user/profile data of web browsers

MassLogger

MassLogger log file

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.