MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8185bd02c507e6433d03c12e5f8b94b574d2f2ebb597e766563fd28295b5d681. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

MassLogger

Vendor detections: 5

Intelligence 5 IOCs YARA 1 File information Comments

SHA256 hash:	8185bd02c507e6433d03c12e5f8b94b574d2f2ebb597e766563fd28295b5d681
SHA3-384 hash:	1ec3309b0e99568f2dbb0a6457631dbe92312eeb423cc228b1ac2b154a53b38fbe49e8aac8e66813e4e64f8224710bfc
SHA1 hash:	30b2655b042043cea29b50ca9b418065b3223bdd
MD5 hash:	163f4507b66481d36fa511c0f056f20d
humanhash:	tennis-ceiling-burger-foxtrot
File name:	Consulta de productos.exe
Download:	download sample
Signature	MassLogger Create hunting rule
File size:	2'068'480 bytes
First seen:	2020-06-18 15:32:02 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep	24576:w/vn3d9F1iPMTVTG+hMJeWbOU6gkgc5BDb5bvOPjj61:A9FmCTGFJeWbTXkZJJvOP3q
Threatray	626 similar samples on MalwareBazaar
TLSH	FDA58D3E3583540DD42886B4083EEAC57A397F853A5A8A2EB1CF530C8F4394F7BA655D
Reporter	abuse_ch
Tags:	exe MassLogger

abuse_ch

Malspam distributing MassLogger:

HELO: slot0.rebelliongate.xyz
Sending IP: 45.95.169.223
From: info@alliedimportexport.com
Reply-To: info@alliedimportexport.com
Subject: Interesado en tus productos
Attachment: Consulta de productos.CAB (contains "Consulta de productos.exe")

MassLogger SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Gathering data

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2020-06-18 14:22:43 UTC

AV detection:

26 of 31 (83.87%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=qgc32awfa7tegpidyexf7c4uwv2nf4xlwwl6ozswh7jiffnv22aq._file

Verdict:

malicious

MassLogger

22d10edc3d0457dd81ee6cd9353e76b3208f8a549c290b80dea1efbbbe120c0b

MassLogger

4dfa820d0e37418dbd81c9c217608dac6dc1b59391c0e49839662f522edd26a1

MassLogger

50ff0aae0a9f7c1fc39e15483e5ebf8235d18c9d9ef2a5bd75a538c0a42e444e

MassLogger

873d9e2252783bc8e2e14a30b8f85f3034a8fbf6ade7aaa24a8173fb85dd092c

MassLogger

8b74dcd5ef2fc40d86bc26ed2385d80ab520ad845a4c1b101f3ba13ff36fb35e

MassLogger

91ab9b169f8b0c05ab795c52b0e41f34374bb828c16176eda1f121c1dbc12731

MassLogger

97430106f3fbf62f0c11f473012392d5b9eaeade9a0f2c6c7ea21e8d6d69f02c

MassLogger

b4e5394cabb090592d987c1ee9bbee93b2f4aeb907cbbb70b62554f1bfc773eb

MassLogger

dde62265df0b255aa06ac36fe0ac09ba40c87a92c4d29d4b823227c68a29e869

MassLogger

+ 616 additional samples on MalwareBazaar

Result

Malware family:

masslogger

Score:

10/10

Tags:

ransomware spyware stealer family:masslogger

Link:

https://tria.ge/reports/200624-7ne9tqpw16/

Behaviour

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

Suspicious behavior: AddClipboardFormatListener

Suspicious use of SetThreadContext

Looks up external IP address via web service

Loads dropped DLL

Reads user/profile data of web browsers

Executes dropped EXE

MassLogger log file

MassLogger

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.