MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6299f3e36dc84d0d1aa0b460cfe353d8460f8aae5b13aa75aab9d8ea2efc1a7a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

MassLogger

Vendor detections: 5

Intelligence 5 IOCs YARA 1 File information Comments

SHA256 hash:	6299f3e36dc84d0d1aa0b460cfe353d8460f8aae5b13aa75aab9d8ea2efc1a7a
SHA3-384 hash:	34244693a104de5ada991ed20bdf48d9e388c1854eb2891fd144f40203e64a7d0cc4fe1ccbf74073aa3caf944c8ef0d9
SHA1 hash:	4e75610144b4d9ffe655ea9b57bb2d7f9798f799
MD5 hash:	7372c7f0f6b0701cbc50fd9825197dc9
humanhash:	autumn-sixteen-wyoming-moon
File name:	ORDER .exe
Download:	download sample
Signature	MassLogger Create hunting rule
File size:	939'008 bytes
First seen:	2020-06-09 06:38:59 UTC
Last seen:	2020-06-10 06:11:10 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep	24576:QAl/v68+6rv9htuUdao2lOGEC+qfiHHJ6ORGJkaLBRr:R/v/+qLheffngsdZLBR
Threatray	459 similar samples on MalwareBazaar
TLSH	D41502117384F216CAAC56B4D99A1934C3BA58837F31EA056E5B13D29AD3F40BE14FCE
Reporter	abuse_ch
Tags:	exe MassLogger

abuse_ch

Malspam distributing MassLogger:

HELO: crimsonintl.com
Sending IP: 37.49.224.211
From: Ehsan <sales@crimsonintl.com>
Reply-To: Ehsan <sales@crimsonintl.com>
Subject: Request for PI
Attachment: ORDER.rar (contains "ORDER .exe")

MassLogger SMTP exfil server:
mail.privateemail.com:587

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Gathering data

Threat name:

ByteCode-MSIL.Trojan.Wacatac

Status:

Malicious

First seen:

2020-06-09 06:40:09 UTC

AV detection:

26 of 31 (83.87%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=mkm7hy3nzbgq2gvawrqm7y2t3bda7cvolmj2u5nkxhmoulx4dj5a._file

Verdict:

malicious

MassLogger

64a0f19845c2724ec1e75467da1f1cab42ef3a78914171af40a0c4c8f798a9fd

MassLogger

740937dc2e4ce55ffde8c557976b25715c76db9ee3d7dd0e8f866983575c8621

MassLogger

8c3156c901bae62d20fce1aa07a4c0e0252ac6ab6443877396a37f83441f2b65

MassLogger

9336f77019f21d2e8e512509c4c246925c6b3cf96d03ac45f080bbc330055d7b

MassLogger

d2827b9a0edb006fbb6ade9f63d0948515ace0f6199a5a59725b8279eed54f25

MassLogger

e337cef021313425e1bb071d32482f61722d1980e8bb0d2deac6c2cd1f7bce55

MassLogger

e772c14876f251ad71aa44567a90859fef8979860f44c77981d537fca37e7400

MassLogger

f1542701299aa44f2329dde6c86e571ebd11566aec5700ae5dd48c283d7ef6ac

MassLogger

f98d355a4771e886220488b0bffa005af9769480cde5aad275d4166c2f9b2e48

MassLogger

+ 449 additional samples on MalwareBazaar

Result

Malware family:

masslogger

Score:

10/10

Tags:

family:masslogger ransomware rezer0 spyware stealer

Link:

https://tria.ge/reports/201109-zt3neztvha/

Behaviour

Creates scheduled task(s)

Suspicious behavior: AddClipboardFormatListener

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Looks up external IP address via web service

Checks computer location settings

Reads user/profile data of web browsers

ServiceHost packer

rezer0

MassLogger

MassLogger Main Payload

MassLogger log file

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.