MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5c826e35fe48ce5410e9c553242a83e71b2408a57d3256bcd0bd4334412010b0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 4


Intelligence 4 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5c826e35fe48ce5410e9c553242a83e71b2408a57d3256bcd0bd4334412010b0
SHA3-384 hash: f28f9c4ea68b5432aaeb69334403d554461e3e46bd3c62fec9bcd08e35038e533326f284eea8732dd6df4ce8688dc455
SHA1 hash: 5c80c907e0792bdf8d6d4a48ebcbb3493570b78b
MD5 hash: aa5fb011e59d1e2a8bef56360a4f31b4
humanhash: oven-angel-earth-tennessee
File name:P.O250520.exe
Download: download sample
Signature MassLogger
Create hunting rule
File size:835'072 bytes
First seen:2020-05-25 12:24:33 UTC
Last seen:2020-05-25 12:53:47 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 24576:jmlz5fvYKPAir3Qv9+V5cd3wMGp0ULfIO4Q:SlFvYKNTew3d4Q
Threatray 495 similar samples on MalwareBazaar
TLSH 5A05234472BA63AFF93F67F6690020042776719A2516E78CEEC234DA1D6DF81E852F13
Reporter abuse_ch
Tags:exe MassLogger


Avatar
abuse_ch
Malspam distributing MassLogger:

HELO: dykbd.com
Sending IP: 103.147.184.73
From: info@dykbd.com
Subject: P.O for Newest Order
Attachment: P.O250520.zip (contains "P.O250520.exe")

Intelligence

File Origin
# of uploads :
2
# of downloads :
72
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Siggen9.49554.518.4470.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-25 12:41:36 UTC
File Type:
PE (.Net Exe)
Extracted files:
8
AV detection:
26 of 31 (83.87%)
Threat level:
  2/5
Verdict:
malicious
Similar samples:
23d36a5f91a4d65b1c22377726d6e8765b36359abd59952511881bdfd20e4fd1
MassLogger
2ae5e19dd2e891ea8c09b48a7e0805a2f797cdfe841c0d71acc90d58eef5e94f
MassLogger
3034f3ef4bb5b6973f011a80e6c06ff87931be0121b86153361c5b1845da6b87
MassLogger
38525021970c707fe513c2589e60dbd8ee2d052e1f4700837a5b132b28baaa33
MassLogger
537b7da6fce7f85c0343f1f181e3235afa6089e16b58f094213bee5b274cc676
MassLogger
581b90c7085ad0b66ddd0d9a3b66942fb5610ff74ebe16bb7f849fdab7358937
MassLogger
94581916a6f0f8c4c0e9238fb1ec9ee8f44035e750f7a41115e68ebe526e6ee4
MassLogger
96fddf8ed5ba87a03b03c5e0387ab1f3ef44df00ce11d0761a108d6407472c86
MassLogger
9c5b8535e2ac554768c5cfc3d655a3aed7647fe2280e66161a516296eb5a5918
MassLogger
e600c55644ad7de134de19f4a284b041ca4090a38cb6306141a10df911596b08
MassLogger
+ 485 additional samples on MalwareBazaar
Result
Malware family:
masslogger
Create hunting rule
Score:
  10/10
Tags:
family:masslogger coreentity ransomware rezer0 spyware stealer
Link:
https://tria.ge/reports/201109-nm28grddk2/
Behaviour
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Looks up external IP address via web service
Reads user/profile data of web browsers
rezer0
CoreEntity .NET Packer
MassLogger
MassLogger Main Payload
MassLogger log file
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:masslogger_gcch
Create hunting rule
Author:govcert_ch

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

zip 8f454599de85acba90becf21df70d90ee0c760b58f7fb86b12a5d29d98efc62b

MassLogger

Executable exe 5c826e35fe48ce5410e9c553242a83e71b2408a57d3256bcd0bd4334412010b0

(this sample)

  
Dropped by
MD5 937608e55e5fb44ee80054d3041591e7
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 8f454599de85acba90becf21df70d90ee0c760b58f7fb86b12a5d29d98efc62b

Comments