MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 60464dbfb4a5cb7227d3afe20367adb84757365e1b9a466ef95c0c96c28b31cf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

MassLogger

Vendor detections: 5

Intelligence 5 IOCs YARA 1 File information Comments

SHA256 hash:	60464dbfb4a5cb7227d3afe20367adb84757365e1b9a466ef95c0c96c28b31cf
SHA3-384 hash:	6c98cc8959c7edbf898e3628b6e061f412e17398a426f1f9501b26b5633ed2a4b7bdb14aa05eb66747e7e3d573a4e7ea
SHA1 hash:	d1d71a586ea0fdc9cf2f3e584145337c0580d7b3
MD5 hash:	1e9264b9a9412d1de2a4ddf9d062f9d9
humanhash:	london-six-speaker-mexico
File name:	DHL SHIPPING DOCUMENT.exe
Download:	download sample
Signature	MassLogger Create hunting rule
File size:	1'007'104 bytes
First seen:	2020-07-01 16:10:36 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep	24576:/XBt9e29apQ3uktmEi2nbEj4HCZ+Oqk/etjoj:X9ebpmfm2nbEciZ2sCc
Threatray	617 similar samples on MalwareBazaar
TLSH	A525F08572BA4B92EABB47FB4932980047FAB87D602ED2590DC774DF85A1F004F55B23
Reporter	abuse_ch
Tags:	DHL exe MassLogger

abuse_ch

Malspam distributing MassLogger:

HELO: vps.signform-pl.me
Sending IP: 45.95.169.216
From: DHL Express logistics <eg.tracing@dhl.com>
Subject: Fwd: RE: URGENT::::DHL tracking no 4680921932
Attachment: DHL SHIPPING DOCUMENT.z (contains "DHL SHIPPING DOCUMENT.exe")

MassLogger SMTP exfil server:
mail.elkat.com.my:587

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Gathering data

Detection(s):

SecuriteInfo.com.Artemis1E9264B9A941.15893.UNOFFICIAL

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/60464dbfb4a5cb7227d3afe20367adb84757365e1b9a466ef95c0c96c28b31cf/

Threat name:

ByteCode-MSIL.Trojan.Kryptik

Status:

Malicious

First seen:

2020-07-01 13:09:54 UTC

AV detection:

24 of 29 (82.76%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=mbde3p5uuxfxej6tv7ragz5nxbdvons6donem3xzlqgjnqulghhq._file

Verdict:

malicious

MassLogger

25fc942b81a074fe6b40b2f817fb87d28a54949bf604e54c414c890a351b83e4

MassLogger

2e4efd8081c1f404f225783de4e421b212cb451e9ac8202616bf6946d70151d4

MassLogger

64ac97cf73567009fd4ea4707b2c0ac2917c74842a81bddf874889d772bf9146

MassLogger

77308f79f7cb15139144f338622072fe4adab5f73debb682a349fbee8700c4ed

MassLogger

93a1f0fa0637acd096c86ec4d7d3c6f73f689bf41f3cd16b5e5bcce48dcdc540

MassLogger

9c7b335e031c3c2fde1e7d75cbe08bd0951b0cb8a327fa4bd3e54c4c59d32936

MassLogger

b74131f0e776928368dad6576cd55844d766a94605616c29a6d4b045efb6bfe6

MassLogger

c9dcd1d7470488ed72d4a673592ab0c4684124dc7e69bb903d47d6a71ffe42fd

MassLogger

e5a67f4da5b8e9ecd086bfa4f6b8e49843656d2dd8adba4840ee9cf46da3054e

MassLogger

+ 607 additional samples on MalwareBazaar

Result

Malware family:

masslogger

Score:

10/10

Tags:

ransomware stealer spyware family:masslogger

Link:

https://tria.ge/reports/200701-cwt7ngx4na/

Behaviour

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetThreadContext

Looks up external IP address via web service

MassLogger log file

MassLogger

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.