MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4474bd1e6a8472755ccac7d31beeefa7575b8b89610b71d1d08cf95a0ca17358. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4474bd1e6a8472755ccac7d31beeefa7575b8b89610b71d1d08cf95a0ca17358
SHA3-384 hash: 4ac61bd6504b4edbf5e3488d26796d3989fdef4b31677ed14823e627d81a27ec48e42fcdfd7926da5323fae6fe1a8843
SHA1 hash: c53e68fe71b695e2c7fb6c05aedb422bf5856f7b
MD5 hash: bacf582001e91e3393c2aef245ace9a0
humanhash: lion-enemy-shade-lima
File name:CONTRACT PO CONFIRMATION!.exe
Download: download sample
Signature MassLogger
Create hunting rule
File size:1'150'976 bytes
First seen:2020-09-09 05:32:21 UTC
Last seen:2020-09-09 07:36:53 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 24576:2MOfNQm+7K/rTpVF2RiMKt34x/rrMt2I132fq:5uGKDrF2RiMW34/nf
TLSH 443522167AD65915D03A3237423A520443F127412597DB3FF8BB32EB8E43FB97826AC6
Reporter cocaman
Tags:exe MassLogger

Intelligence

File Origin
# of uploads :
4
# of downloads :
107
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/58044/
Detection(s):
SecuriteInfo.com.ArtemisBACF582001E9.9337.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Using the Windows Management Instrumentation requests
Creating a file
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4474bd1e6a8472755ccac7d31beeefa7575b8b89610b71d1d08cf95a0ca17358/
Threat name:
ByteCode-MSIL.Trojan.NanoBot
Create hunting rule
Status:
Malicious
First seen:
2020-09-09 01:21:29 UTC
File Type:
PE (.Net Exe)
Extracted files:
7
AV detection:
25 of 29 (86.21%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ir2l2htkqrzhkxgky7jrx3xpu5lvxc4jmefxduoqrt4vudfbonma._file
Result
Malware family:
masslogger
Create hunting rule
Score:
  10/10
Tags:
ransomware spyware stealer family:masslogger evasion
Link:
https://tria.ge/reports/200909-2hw8l856l6/
Behaviour
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Looks up external IP address via web service
Maps connected drives based on registry
Checks BIOS information in registry
Checks computer location settings
Reads user/profile data of web browsers
Looks for VMWare Tools registry key
Looks for VirtualBox Guest Additions in registry
MassLogger
MassLogger log file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
MassLogger
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4474bd1e6a8472755ccac7d31beeefa7575b8b89610b71d1d08cf95a0ca17358

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

zip 12b5b8adeb972d937a1e442c0c19059a5f2ef1f5785122c905242544b7dfab6c

MassLogger

Executable exe 4474bd1e6a8472755ccac7d31beeefa7575b8b89610b71d1d08cf95a0ca17358

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 12b5b8adeb972d937a1e442c0c19059a5f2ef1f5785122c905242544b7dfab6c
Cape
Cape
https://www.capesandbox.com/analysis/58044/

Comments