MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 95d334eb3cabab89dede94fa1fdfb66560e7ca453ac25be1729a5c0d2e783934. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 8


Intelligence 8 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 95d334eb3cabab89dede94fa1fdfb66560e7ca453ac25be1729a5c0d2e783934
SHA3-384 hash: d3202ec6e88fdd4963d1ba9bdf0daac76b17c2b8e1e69e64682dcba54561875781f49b44f48c847ae82ff254886417fd
SHA1 hash: d492b42e398327d745b8b8290ac251ab1e6c2c3d
MD5 hash: 93e48f120ba81debffe7253e48a5db99
humanhash: connecticut-louisiana-florida-twelve
File name:Purchase Order POKD006192.exe
Download: download sample
Signature MassLogger
Create hunting rule
File size:1'028'608 bytes
First seen:2020-08-04 11:27:05 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:+HX8kTVTfUvNSZ54DQc6U1ekJmx8dnOMFpdE/cfpp8Nw9ZnNSEYkgh2z51rID+:+HLTtUviTOe8dnOMfiM0W9NYkWAbB
Threatray 1'472 similar samples on MalwareBazaar
TLSH F1257C363C47847DC92A46B588AC9ED7B2247A8A3B59CE5E708B530CAE0309F775345F
Reporter abuse_ch
Tags:exe MassLogger


Avatar
abuse_ch
Malspam distributing MassLogger:

HELO: slot0.griferaisnova.com
Sending IP: 107.174.244.100
From: order@keydistributors.co.za
Subject: Purchase Order POKD006192
Attachment: Purchase Order POKD006192.gz (contains "Purchase Order POKD006192.exe")

MassLogger SMTP exfil server:
http://torlago.com/wp-owe/panel/

Intelligence

File Origin
# of uploads :
1
# of downloads :
75
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Ispy
Create hunting rule
Link:
https://www.capesandbox.com/analysis/38592/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Unauthorized injection to a recently created process
Creating a file
DNS request
Sending an HTTP GET request
Using the Windows Management Instrumentation requests
Setting a global event handler for the keyboard
Result
Threat name:
MassLogger RAT
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/409194
Signature
.NET source code contains very large array initializations
Found malware configuration
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
May check the online IP address of the machine
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to steal Mail credentials (via file access)
Yara detected MassLogger RAT
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/95d334eb3cabab89dede94fa1fdfb66560e7ca453ac25be1729a5c0d2e783934/
Threat name:
ByteCode-MSIL.Backdoor.Bladabhindi
Create hunting rule
Status:
Malicious
First seen:
2020-08-04 11:29:04 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=sxjtj2z4vovytxw6st5b7x5wmvqopssfhlbfxylstjoa2ltyhe2a._file
Verdict:
suspicious
Similar samples:
0ce85115b26d769cc29342f77c359fc2177d325e5394154fdc700ea644f69971
MassLogger
329a2570a79a64645c307b832f6bf62abeb151c14f6f608fd1d3b806a427da9d
MassLogger
35b6e2b8511ae0552a5de87abc510205a9d52a53ca6ed78b44299a31138475c8
MassLogger
4534997b5b146c7caebb2f398e7ea0f2bbf434af23155ad13b0acd09b0487325
MassLogger
801125439e5dd24dcb12ecdcad2f6166351c5b55f7d627b99db92d4fa85435f6
MassLogger
a23aaa00f7b68ac090aaec5ffbd32d5a9a557333302e72fba232f2f54b38cbbc
MassLogger
a4df7bd8daff5a4723055c7589244e1719c45223f09f42b06a621aad5ee1f2f4
MassLogger
b56dc20e7a6a6b86fb49f3802961cc8b21b75938af4de7bb55db894a8546246c
MassLogger
cf9aa52cd8829760f779772b7b483ff039100b5d6311c85f969553b6ce66d58b
MassLogger
eb98cd837c0994df93bde2019caef785c7b7c9bfc373ca2135d928bd507bf3b3
MassLogger
+ 1'462 additional samples on MalwareBazaar
Result
Malware family:
masslogger
Create hunting rule
Score:
  10/10
Tags:
ransomware spyware stealer family:masslogger
Link:
https://tria.ge/reports/200804-y687hk89rx/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious use of SetWindowsHookEx
Suspicious behavior: AddClipboardFormatListener
Suspicious use of SetThreadContext
Looks up external IP address via web service
Reads user/profile data of web browsers
MassLogger log file
MassLogger
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.94
Link:
https://yomi.yoroi.company/submissions/95d334eb3cabab89dede94fa1fdfb66560e7ca453ac25be1729a5c0d2e783934

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:masslogger_gcch
Create hunting rule
Author:govcert_ch
Rule name:win_masslogger_w0
Create hunting rule
Author:govcert_ch

File information

The table below shows additional information about this malware sample such as delivery method and external references.

e0cc4afded31b8526923fec341c4ab34

MassLogger

Executable exe 95d334eb3cabab89dede94fa1fdfb66560e7ca453ac25be1729a5c0d2e783934

(this sample)

  
Dropped by
MD5 e0cc4afded31b8526923fec341c4ab34
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/38592/

Comments