MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 36bb4745d0a342a57dbd7c668aed07e956ff166df4864e21b0770e790f734acc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

MassLogger

Vendor detections: 5

Intelligence 5 IOCs YARA 1 File information Comments

SHA256 hash:	36bb4745d0a342a57dbd7c668aed07e956ff166df4864e21b0770e790f734acc
SHA3-384 hash:	77ff1e13e55828e123b0e101737d849ef6da064590bda3235be401d5a2e80a775c48885ecfadd587460e8bcb44e45afe
SHA1 hash:	6f6d92f2c76755359e0c107c3b8b1cd1651980fe
MD5 hash:	2e51f70c086cea3e8fdd12f3e7c4d365
humanhash:	bulldog-georgia-south-florida
File name:	Company Document.exe
Download:	download sample
Signature	MassLogger Create hunting rule
File size:	907'264 bytes
First seen:	2020-06-04 07:27:05 UTC
Last seen:	2020-06-05 16:29:34 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep	24576:cxb0Ecnh4/gxvG1PDRi1wTXVFsCoTBDp2H4o:SozIRDAArs3tDpSt
Threatray	1'976 similar samples on MalwareBazaar
TLSH	4A1501613229AA2BC77D52F50850280557F4C05A3CAAE2CDEDE969EF56D6FC04BD0F83
Reporter	abuse_ch
Tags:	exe MassLogger PWC

abuse_ch

Malspam distributing MassLogger:

HELO: pwc.com
Sending IP: 37.49.224.134
From: Kazi Islam (IN) <kazi.n.islam@pwc.com>
Subject: Cyber Security service offerings for Manufacturing Industries and RMG
Attachment: Company Document.rar (contains "Company Document.exe")

MassLogger SMTP exfil server:
mail.privateemail.com:587

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL

Gathering data

Threat name:

ByteCode-MSIL.Trojan.Kryptik

Status:

Malicious

First seen:

2020-06-04 08:23:30 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

16 of 31 (51.61%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=g25uoroqunbkk7n5prtiv3ih5flp6ftn6sde4inqo4hhsd3tjlga._file

Verdict:

malicious

MassLogger

0bc730f8804a7ca3bb1ce3ef623dd0589d5813086d950b9173c8294293070a16

MassLogger

18160b7700ff83693e0aa6c2e947ac4a6c1a286fd4845847f90aa2ba6662f54e

MassLogger

2488817fd7589194d1a7781f8975be361c8153177af6f79c9c5b06960810f05c

MassLogger

57f1c863e4e30e3daf8c2615372fc1961ec72e92de7b6eab13b08f25656d1530

MassLogger

82d32f5841ba04262e4b1a15d798cfbd69a4bc9ebd37caf3573818e7a2140639

MassLogger

898abdb2d9de0344e5b43ac7e4330faeb03d97aa0a3c37e0a37da0ed4d732e9b

MassLogger

9a813db555b2a251a1068f50b1b02d642bb570337058f7f3a7028cafccbe1f54

MassLogger

ec89b2b660ea42254a90f3b045dc98bfe6d1733878bd39a2a7030d68de169859

MassLogger

f0f7f9f3d293065a8554c6b9e4757bf511dd3577636ca1a075e0afd206250e5e

MassLogger

+ 1'966 additional samples on MalwareBazaar

Result

Malware family:

masslogger

Score:

10/10

Tags:

family:masslogger ransomware rezer0 spyware stealer

Link:

https://tria.ge/reports/201109-gx6l2k8hn2/

Behaviour

Creates scheduled task(s)

Suspicious behavior: AddClipboardFormatListener

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Looks up external IP address via web service

Checks computer location settings

Reads user/profile data of web browsers

rezer0

MassLogger

MassLogger log file

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.