MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6e9f7bde41c353c8f2f492dd4e41454a45a8d8d222f2593d7174dca50e410f44. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

MassLogger

Vendor detections: 4

Intelligence 4 IOCs YARA 1 File information Comments

SHA256 hash:	6e9f7bde41c353c8f2f492dd4e41454a45a8d8d222f2593d7174dca50e410f44
SHA3-384 hash:	0c5a87b8e1be52986fc47884ff4c3667671f20ddfabcf0547d605a687c478615e32e8a8d1ee0e8dd6e62a574b7fb94a5
SHA1 hash:	a9fbedc442becda6791c1d1328fbfd834dcc4477
MD5 hash:	1c47a90df5889a4705a226e1081fcbb9
humanhash:	fourteen-floor-georgia-leopard
File name:	M02006088349.exe
Download:	download sample
Signature	MassLogger Create hunting rule
File size:	820'224 bytes
First seen:	2020-06-24 05:48:20 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep	24576:i1aSlZfk9KL1idI7YemSfbCbdsIFnMCBc8ueKzzCBM+xuxk:iMoBPL1iRSDCb3MCEnCBM+xuS
Threatray	467 similar samples on MalwareBazaar
TLSH	AA0522FB2D925A57CEAD59FDE4D0298147F181298283E34ACD99C67F0E473F2444B0A7
Reporter	abuse_ch
Tags:	exe MassLogger

abuse_ch

Malspam distributing MassLogger:

HELO: 1076.vps.hostfactory.ch
Sending IP: 185.66.108.99
From: Girish Joshi <dy.cfo@fujairahport.ae>
Subject: Purchase Order 806247
Attachment: M02006088349.zip (contains "M02006088349.exe")

MassLogger SMTP exfil server:
mail.cyberclone.biz:587

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/13431/

Detection(s):

SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/6e9f7bde41c353c8f2f492dd4e41454a45a8d8d222f2593d7174dca50e410f44/

Threat name:

ByteCode-MSIL.Trojan.Kryptik

Status:

Malicious

First seen:

2020-06-24 05:50:06 UTC

AV detection:

20 of 29 (68.97%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=n2pxxxsbynj4r4xuslou4qkfjjc2rwgselzfsplrotokkdsbb5ca._file

Verdict:

malicious

MassLogger

14fd527270413bbe03889b5082000818055ae981fd2ea0df41f24ff34c7c4621

MassLogger

1a1e5e11d4fc8b5b0b1b8d7ba56879a75c9079aa63c613d2f266a1b84bc15cfd

MassLogger

3142e234938b7d0d3bccb3faada5555b00f9e5d8fe9fc7dba7efe07ae03e4d99

MassLogger

6477024ed851023f3d69427ca14e9744d5cc6401daae7566dbbe6732788e721e

MassLogger

8f5a34f80165dd3b125af00e0f799000581693356c589931ac12a3eca44dba2d

MassLogger

d6dcf42227c7121a1dae639d8c22a5474e016605e0300909db70665b580ab8ed

MassLogger

ebc70b3a49276d78bea1209073f9855253b5110034c8159c704dde0ebd248008

MassLogger

ed23e691927f32d5c2d18f5b763fcc71fa62c6150233b1dbcf967d13521ef8f6

MassLogger

fea29955349c7f4aaf2ea1e18e1d366a643e2ed98706b168a909e45b633b4f10

MassLogger

+ 457 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

9/10

Tags:

n/a

Link:

https://tria.ge/reports/200624-njn9x4jnge/

Behaviour

Suspicious behavior: EnumeratesProcesses

Creates scheduled task(s)

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Maps connected drives based on registry

Checks BIOS information in registry

Looks for VMWare Tools registry key

Looks for VirtualBox Guest Additions in registry

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.