MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 42ee1657e20e862e7c2602a0e62aa35d3dc26ba22644db5acb13ce074d321781. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 4


Intelligence 4 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 42ee1657e20e862e7c2602a0e62aa35d3dc26ba22644db5acb13ce074d321781
SHA3-384 hash: e5f3778b30f13d65f682141ca2b5bf618e17ed973dded5dc1c458473f76dca5b3a5d5415488d04461a69339f2afe805c
SHA1 hash: a6d81d49b7352a6607507ec1cd895e7b03a2fb09
MD5 hash: a94b5ad8b88534df81d0e13149ee33e8
humanhash: oven-skylark-stream-wisconsin
File name:Inquiry.exe
Download: download sample
Signature MassLogger
Create hunting rule
File size:781'824 bytes
First seen:2020-06-23 06:55:34 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:tZhSpX0gZhNONMudTQEiJm3XuAeXtL+ipGT15u+T+lCSWHtAx9BFUHwmNG:VSpOZQEi+e/dks4BSWHax9Bl
Threatray 940 similar samples on MalwareBazaar
TLSH ABF423E9A7504AEDF99D0E799027864400FFA011A4F1FF0DCA2E9C453B9B74387897A7
Reporter abuse_ch
Tags:exe MassLogger


Avatar
abuse_ch
Malspam distributing MassLogger:

HELO: triventek.com
Sending IP: 37.49.224.134
From: jh@triventek.com
Subject: URGENT!! Quote Request
Attachment: Inquiry.rar (contains "Inquiry.exe")

MassLogger SMTP exfil server:
mail.privateemail.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
80
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/12877/
Detection(s):
SecuriteInfo.com.Generic.mg.08dca873988dcf0c.7936.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/42ee1657e20e862e7c2602a0e62aa35d3dc26ba22644db5acb13ce074d321781/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-23 06:57:04 UTC
AV detection:
25 of 31 (80.65%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ilxbmv7cb2dc47bgakqomkvdlu64e25cezcnwwwlcphaotjsc6aq._file
Verdict:
suspicious
Similar samples:
2e38449ec685638089e3863a2c03ba15c8b18b16f9e75ec869a4b87c34aabd28
MassLogger
5caa7e9eb486ca9161d410e9fe1dc4074c3b0c66f8d6cd05ab5ae6dd35837c5a
MassLogger
958a75638f244908b46438a9b3d3b86449cdcebb6b0fce3552a1f0a31b65c9ae
MassLogger
97b4fea61d49c93281c6a9b0e058bd747c1cc85458889ce745e577414db2a8dd
MassLogger
acc9376fa35884a2d062414addf12c3a57f59afa20b60dd3b294fe868e1993ad
MassLogger
cd84429e1881bd2029dc69963d9fd46049b11c50e2af7b8aae34ec877dda42e9
MassLogger
d0a91b95684f4e1b9b5f1c8987782f209f1eb91b06c1866d80036ade4810ec92
MassLogger
e42cda0296600ccc7c258f266f41762997892d4d82ce7b8c9e9d95585a6aaa68
MassLogger
e49a706ea3ef99b6bd3d90fbf970e1ab6c7203d622bf3e2565b9ecd3b4e9cc7a
MassLogger
f7ecd0e638cbffb3b985691c57451ea93845e8f16e4003d0f91ba3f02eb54c03
MassLogger
+ 930 additional samples on MalwareBazaar
Result
Malware family:
masslogger
Create hunting rule
Score:
  10/10
Tags:
ransomware spyware stealer family:masslogger
Link:
https://tria.ge/reports/200624-wcbg88jt6a/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Suspicious use of SetWindowsHookEx
Creates scheduled task(s)
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: AddClipboardFormatListener
Suspicious use of SetThreadContext
Looks up external IP address via web service
Reads user/profile data of web browsers
MassLogger
MassLogger log file
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:masslogger_gcch
Create hunting rule
Author:govcert_ch

File information

The table below shows additional information about this malware sample such as delivery method and external references.

995654701fb5e3cbc22211d611cfab18

MassLogger

Executable exe 42ee1657e20e862e7c2602a0e62aa35d3dc26ba22644db5acb13ce074d321781

(this sample)

  
Dropped by
MD5 995654701fb5e3cbc22211d611cfab18
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/12877/

Comments