MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7b6cb4a94f2899f6363bbaeab018125a20310d9ad1d22b121d004803914fb378. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7b6cb4a94f2899f6363bbaeab018125a20310d9ad1d22b121d004803914fb378
SHA3-384 hash: 0fdad52c82f2c414f4bd3e63ee57b0bd45982d03747be84885673e497769ecba4bb2df677d197b30f3e7c4da2862b54c
SHA1 hash: a997eece939a77b279d62adffa2ef91f84794538
MD5 hash: c2840f6bf3243c09e6758e5c38494c40
humanhash: alanine-rugby-romeo-fifteen
File name:Business Register.exe
Download: download sample
Signature MassLogger
Create hunting rule
File size:2'498'048 bytes
First seen:2020-06-18 09:37:08 UTC
Last seen:2020-06-18 11:00:58 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 49152:19FmCTGFJeWbTXkZJJvOP3q/jFUhHb1JVe:zHCFdbTUr0Pq/jFUh71JV
Threatray 600 similar samples on MalwareBazaar
TLSH 52C5AE3A74865419C5384275806EDEC1A63E6F867B428E5E71CBB30C9F5361F7BA302E
Reporter abuse_ch
Tags:exe MassLogger


Avatar
abuse_ch
Malspam distributing MassLogger:

HELO: slot0.rebelliongate.xyz
Sending IP: 45.95.169.223
From: Business Register<register@ebr-registry.com>
Subject: EU Business Register 2020/2021
Attachment: Business Register.CAB (contains "Business Register.exe")

Intelligence

File Origin
# of uploads :
2
# of downloads :
81
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/19723/
Detection(s):
SecuriteInfo.com.Generic.mg.c2840f6bf3243c09.15051.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-06-18 09:45:33 UTC
AV detection:
24 of 31 (77.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=pnwljkkpfcm7mnr3xlvlagasliqdcdm22hjcweq5abeahekpwn4a._file
Verdict:
malicious
Similar samples:
11fb01319a28b6a6f8163f389fd6bb7ead8d5d29cfb6e802c43314ca5f0ce960
MassLogger
22d10edc3d0457dd81ee6cd9353e76b3208f8a549c290b80dea1efbbbe120c0b
MassLogger
4a8306a06d0986039735160a8457fb8188fbd02015acb84808c97ffd3204020a
MassLogger
4dfa820d0e37418dbd81c9c217608dac6dc1b59391c0e49839662f522edd26a1
MassLogger
50ff0aae0a9f7c1fc39e15483e5ebf8235d18c9d9ef2a5bd75a538c0a42e444e
MassLogger
873d9e2252783bc8e2e14a30b8f85f3034a8fbf6ade7aaa24a8173fb85dd092c
MassLogger
97430106f3fbf62f0c11f473012392d5b9eaeade9a0f2c6c7ea21e8d6d69f02c
MassLogger
b4e5394cabb090592d987c1ee9bbee93b2f4aeb907cbbb70b62554f1bfc773eb
MassLogger
db6d686590ded24cbfc0dfb2be4cd25035d7422c4cf49e6b9bf94469d2573e7d
MassLogger
dde62265df0b255aa06ac36fe0ac09ba40c87a92c4d29d4b823227c68a29e869
MassLogger
+ 590 additional samples on MalwareBazaar
Result
Malware family:
masslogger
Create hunting rule
Score:
  10/10
Tags:
ransomware stealer spyware family:masslogger
Link:
https://tria.ge/reports/200624-khgefwhmbn/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: AddClipboardFormatListener
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetWindowsHookEx
Suspicious use of SetThreadContext
Looks up external IP address via web service
Loads dropped DLL
Reads user/profile data of web browsers
Executes dropped EXE
MassLogger
MassLogger log file
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:masslogger_gcch
Create hunting rule
Author:govcert_ch

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

zip 76b03bb43e03f8fd3e3c246127be09fb90c58a66c6cc04361893a87936383916

MassLogger

Executable exe 7b6cb4a94f2899f6363bbaeab018125a20310d9ad1d22b121d004803914fb378

(this sample)

  
Dropped by
MD5 7d4dd86a4f7ca1210efda2a2d5787283
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 76b03bb43e03f8fd3e3c246127be09fb90c58a66c6cc04361893a87936383916
Cape
Cape
https://www.capesandbox.com/analysis/19723/

Comments