MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8c3156c901bae62d20fce1aa07a4c0e0252ac6ab6443877396a37f83441f2b65. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

MassLogger

Vendor detections: 5

Intelligence 5 IOCs YARA 1 File information Comments

SHA256 hash:	8c3156c901bae62d20fce1aa07a4c0e0252ac6ab6443877396a37f83441f2b65
SHA3-384 hash:	e7a84f4a4f0c65571ade7155591d6d2ca0de5c813d98893ff7e17c552d22464ab75fbf43aa785742390c32c4a98ddbc5
SHA1 hash:	1f95f553fb11d4d6f6b7a6a15a3ed19aba8403ba
MD5 hash:	a009bf5f0bc5b29b3c7f70203584c20c
humanhash:	gee-berlin-pluto-tennis
File name:	Enquiry Items.exe
Download:	download sample
Signature	MassLogger Create hunting rule
File size:	1'079'808 bytes
First seen:	2020-06-09 05:56:51 UTC
Last seen:	2020-06-10 06:04:22 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep	24576:iH24nYdQczFQnW4Hi4cdaUWbqJDgHtiXyPEOAwOv68+UzJ:74nYd5zFQnTHi4cF5gNivOKv/+
Threatray	459 similar samples on MalwareBazaar
TLSH	973502057344E619C4FD86B5C9A2493087E66C823F24D58E2A5B33DAEEB3B41FD14E8D
Reporter	abuse_ch
Tags:	exe MassLogger

abuse_ch

Malspam distributing MassLogger:

HELO: amityindia.com
Sending IP: 37.48.83.19
From: purchase@amityindia.com
Subject: Enquiry
Attachment: Enquiry Items.gz (contains "Enquiry Items.exe")

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Generic.mg.a009bf5f0bc5b29b.16067.UNOFFICIAL

Gathering data

Threat name:

ByteCode-MSIL.Spyware.Masslogger

Status:

Malicious

First seen:

2020-06-09 01:19:57 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

26 of 31 (83.87%)

Threat level:

2/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=rqyvnsibxltc2ih44gvapjga4assvrvlmrbyo44wun7ygra7fnsq._file

Verdict:

malicious

MassLogger

6299f3e36dc84d0d1aa0b460cfe353d8460f8aae5b13aa75aab9d8ea2efc1a7a

MassLogger

64a0f19845c2724ec1e75467da1f1cab42ef3a78914171af40a0c4c8f798a9fd

MassLogger

740937dc2e4ce55ffde8c557976b25715c76db9ee3d7dd0e8f866983575c8621

MassLogger

9336f77019f21d2e8e512509c4c246925c6b3cf96d03ac45f080bbc330055d7b

MassLogger

d2827b9a0edb006fbb6ade9f63d0948515ace0f6199a5a59725b8279eed54f25

MassLogger

e337cef021313425e1bb071d32482f61722d1980e8bb0d2deac6c2cd1f7bce55

MassLogger

e772c14876f251ad71aa44567a90859fef8979860f44c77981d537fca37e7400

MassLogger

f1542701299aa44f2329dde6c86e571ebd11566aec5700ae5dd48c283d7ef6ac

MassLogger

f98d355a4771e886220488b0bffa005af9769480cde5aad275d4166c2f9b2e48

MassLogger

+ 449 additional samples on MalwareBazaar

Result

Malware family:

masslogger

Score:

10/10

Tags:

family:masslogger ransomware rezer0 spyware stealer

Link:

https://tria.ge/reports/201109-4w1zslmkjs/

Behaviour

Creates scheduled task(s)

Suspicious behavior: AddClipboardFormatListener

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Looks up external IP address via web service

Checks computer location settings

Reads user/profile data of web browsers

ServiceHost packer

rezer0

MassLogger

MassLogger Main Payload

MassLogger log file

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.