MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 48cad358250f70cffecaed785f4d128f48174adc0ee5948e00ab1b6ffbef803c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

MassLogger

Vendor detections: 4

Intelligence 4 IOCs YARA 1 File information Comments

SHA256 hash:	48cad358250f70cffecaed785f4d128f48174adc0ee5948e00ab1b6ffbef803c
SHA3-384 hash:	ccc4fce9617ad6d590ea6904cfd78b942268b558925b5dd0fdbb10ead5ef42b5f52b840b30f6abde47b0fc16ad9baf95
SHA1 hash:	d827d7eb28fc2077dd887aef57d0862f7c048860
MD5 hash:	0bcff00665c7d39364e53f1c2a1033d2
humanhash:	nineteen-cup-east-lemon
File name:	img00001.exe
Download:	download sample
Signature	MassLogger Create hunting rule
File size:	1'174'016 bytes
First seen:	2020-06-29 06:36:16 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep	12288:jeLwcXFbVJ9Jh93yljni5Zixrajf0O9ozYoq9MqKeBFv6eF5rGK1bM:ywcXdL9J2LiDix+T0PECe76eFgK1bM
Threatray	2'449 similar samples on MalwareBazaar
TLSH	324528403EB0DC12D89A02B094147EEB1D3D7D43E4E4E16BBA623A9475725BFE5B8C0E
Reporter	abuse_ch
Tags:	exe MassLogger

abuse_ch

Malspam distributing MassLogger:

HELO: delivery.mailspamprotection.com
Sending IP: 146.66.121.9
From: James Smith<info@oasisgrace.com>
Reply-To: James Smith<newlogs147@gmail.com>
Subject: Very Urgent
Attachment: img00001.z (contains "img00001.exe")

MassLogger SMTP exfil server:
mail.mytravelexplorer.com:587

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/15403/

Detection(s):

SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/48cad358250f70cffecaed785f4d128f48174adc0ee5948e00ab1b6ffbef803c/

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2020-06-29 06:38:06 UTC

AV detection:

20 of 29 (68.97%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=jdfngwbfb5ym77wk5v4f6tisr5ebosw4b3szjdqavmnw767pqa6a._file

Verdict:

suspicious

MassLogger

2e38449ec685638089e3863a2c03ba15c8b18b16f9e75ec869a4b87c34aabd28

MassLogger

45808d9b0a58982e3bddb4e711f25d5224ad78165fbeb24b1a720358679bcbc3

MassLogger

48911ded8eb1be557009ec74a427c92481389c32e01c8a1c8935aa8db52bb558

MassLogger

51d9993db6088b6817645cc0054e62926e4f249cb405ae05355a6d4520a46525

MassLogger

6f00ffaa9b0fe22f4e8e46fc35998010ecabecac8ffbdc4629e1b59372393a6b

MassLogger

7cee0e7a663f8a865255723ea5fe89fac90be773094c04ad82b5aee132f50cd7

MassLogger

abe23e12f4aa1f3e0b9ea3777ffaaf4fdcf9ccb21e7331b32d20bfa3a511f6c7

MassLogger

cd84429e1881bd2029dc69963d9fd46049b11c50e2af7b8aae34ec877dda42e9

MassLogger

e7acb91c1fe721b5a2cb5dcae27e69d1ce575cf19a0d929fe6b6ff9b81ebdf9b

MassLogger

+ 2'439 additional samples on MalwareBazaar

Result

Malware family:

masslogger

Score:

10/10

Tags:

ransomware spyware stealer family:masslogger

Link:

https://tria.ge/reports/200629-e73ngsbw66/

Behaviour

Creates scheduled task(s)

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious behavior: AddClipboardFormatListener

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetThreadContext

Looks up external IP address via web service

Reads user/profile data of web browsers

MassLogger

MassLogger log file

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.