MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8b21c06bf03c5f788bb0354c625f343873bc834ac43b1d8fbc469fd64f215cf6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

MassLogger

Vendor detections: 4

Intelligence 4 IOCs YARA 1 File information Comments

SHA256 hash:	8b21c06bf03c5f788bb0354c625f343873bc834ac43b1d8fbc469fd64f215cf6
SHA3-384 hash:	d6e4782e4ae92f86ca162a2ff070ec7f841a61b7622febb6f5b262487102cb1323bbfc374b347ef2abeb9582c1393ada
SHA1 hash:	457cb4a210e0c16e78442f1bf79c9826cf4f982b
MD5 hash:	0faa3c5a42f64964e82ce6a1c46bd9f1
humanhash:	vegan-kitten-johnny-lemon
File name:	ORDER FORM.exe
Download:	download sample
Signature	MassLogger Create hunting rule
File size:	1'189'872 bytes
First seen:	2020-05-27 17:58:42 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep	12288:OMCcIf8aHS/5bcXwkd83yeW5vUohtmi8G+idO8Cw+6upoz69sPw7uYMG:OP9fn85YXwf3yrZRIazQtrJHUwjMG
Threatray	1'768 similar samples on MalwareBazaar
TLSH	0445BC746E674246E1FE53F6345991134FED2EED20B9C3A12430B3BA5EFA38D4990272
Reporter	abuse_ch
Tags:	exe MassLogger

abuse_ch

Malspam distributing MassLogger:

HELO: llsk281-a17.servidoresdns.net
Sending IP: 82.223.190.12
From: rugasa@rugasa.com
Subject: RE:Reference: GOT / 731104 :: Enquriy
Attachment: ORDER FORM.cab (contains "ORDER FORM.exe")

MassLogger SMTP exfil server:
smtp.gmail.com:587

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Generic.mg.0faa3c5a42f64964.19517.UNOFFICIAL

Gathering data

Threat name:

ByteCode-MSIL.Trojan.Frs

Status:

Malicious

First seen:

2020-05-28 02:06:16 UTC

AV detection:

25 of 31 (80.65%)

Threat level:

2/5

Verdict:

malicious

MassLogger

31f91924abcb4657d19721140bb21db8b517dc6a48830c7c5dc53d819c507248

MassLogger

7c65791a28bb5371879626ac09de636c77bc6439e139db1b5110954beeb75d04

MassLogger

94581916a6f0f8c4c0e9238fb1ec9ee8f44035e750f7a41115e68ebe526e6ee4

MassLogger

a4a97ffddcc1f86ee8d3c45421375fb560f3b9aa9428cc3079cffc1edf930d0d

MassLogger

e53b85600f2e1d2c612854eb25aa5ebb3cf93a966aef11b22e186f65cb097506

MassLogger

f5e2764cbde44d86d4b2a73853c98b8e6a9f325f4e187aa1f0af53b9f4844d05

MassLogger

f6557b3412ca78e87ff38632aaf24732b74da646678fd6ea5f01134bb498fd14

MassLogger

f8ac7b65c655d5e604540692e17267d64d0056d89dbdd3e3ff3c03db9b602f79

MassLogger

fe6ae4e601219d9bf84478571167e58466ca08fa917df8407fb5169c69109a72

MassLogger

+ 1'758 additional samples on MalwareBazaar

Result

Malware family:

masslogger

Score:

10/10

Tags:

family:masslogger coreentity ransomware rezer0 spyware stealer

Link:

https://tria.ge/reports/201109-5gz96khbxa/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Looks up external IP address via web service

Checks computer location settings

rezer0

CoreEntity .NET Packer

MassLogger

MassLogger Main Payload

MassLogger log file

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.