MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 70502bb6c9fd88cdce1092f83ef2f6408a039c7b9de5652cd22087159dd8ba28. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

MassLogger

Vendor detections: 5

Intelligence 5 IOCs YARA 1 File information Comments

SHA256 hash:	70502bb6c9fd88cdce1092f83ef2f6408a039c7b9de5652cd22087159dd8ba28
SHA3-384 hash:	5f8d0fcdcaf778779c27d7dac6ac6d3d88fad1cb67537993d5192a2906fe2853d29d919ce50a8f9a04250d218dedfd80
SHA1 hash:	79eea20c462aba792a1f0eca0d23c76f954a3c8b
MD5 hash:	25f14213809e9a73bb703503fdd72df7
humanhash:	social-solar-hotel-quiet
File name:	cxaunOASPiVka6y.exe
Download:	download sample
Signature	MassLogger Create hunting rule
File size:	981'504 bytes
First seen:	2020-06-03 12:42:14 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep	24576:Gz55AqX2JyBcciVt5JXtq51mfWDRNjlhHh3:M5rEyBc5PgWfQtHh
Threatray	379 similar samples on MalwareBazaar
TLSH	C925E09C362072EFC867D4729EA82C74EA5574BB571F4213A02711EDAE5D88BCF241F2
Reporter	jarumlus
Tags:	AgentTesla MassLogger

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Gathering data

Threat name:

ByteCode-MSIL.Trojan.Genkryptik

Status:

Malicious

First seen:

2020-06-03 00:57:19 UTC

AV detection:

19 of 31 (61.29%)

Threat level:

2/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=obicxnwj7wem3tqqsl4d54xwicfahhd3txswklgsecdrlhoyxiua._file

Verdict:

malicious

MassLogger

100b0b79aaaf948df42bb2b46ad0a6e57c67e2b2a7d91d16c225c24c77f70d2a

MassLogger

2fff208eaaf2f71f4114ed722a48ffb147ebe2db14f241e0506fa8692dc03ab3

MassLogger

397dd4bc6657e428ed2b5d3bcf09d3409d943796cfe5d096583c85ff8a3340b1

MassLogger

4fd457b5e2ff2430dbce5692ba6c47253ade9e105ffb192d01aee29d6ba7c912

MassLogger

bd72223afa837379fe320c88e0c18d6bffaa463615b4d68c1afbfd3bac4f5f93

MassLogger

c2be817a60ed0f80dc7f6e3e5eafc3db7a7a170e1df0015e2189cd9daecec6c8

MassLogger

e245394d284c52b53c088927f7548cccff63b0bdc36427c1e4f6f66edc3153bd

MassLogger

ed02a2653566d5a67a9b1863d02ed672b1947a6566cc61464f0d7a24ea335074

MassLogger

f6853a25abff371818a7a5852ecaf8b01482577e3f2a4eb1ca2093b739d1601c

MassLogger

+ 369 additional samples on MalwareBazaar

Result

Malware family:

masslogger

Score:

10/10

Tags:

family:masslogger coreentity ransomware rezer0 spyware stealer

Link:

https://tria.ge/reports/201109-sjednfyhf6/

Behaviour

Creates scheduled task(s)

Suspicious behavior: AddClipboardFormatListener

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Looks up external IP address via web service

Checks computer location settings

Reads user/profile data of web browsers

rezer0

CoreEntity .NET Packer

MassLogger

MassLogger log file

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.