MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a325f636f8f04610f7abed81f75739bba89f86d802415efd6725e127619cbf02. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a325f636f8f04610f7abed81f75739bba89f86d802415efd6725e127619cbf02
SHA3-384 hash: 079cbad63e2ded0a871f61414f86f306dced98c99e1d82b89401d5d207aa060dd4d16c3ba6f327c4e70dabadb8c7784d
SHA1 hash: 4b43c9d693138820ff913f0319702165630cfa5e
MD5 hash: 10fbc2c2ca8d28b393a807c6991ffa4a
humanhash: blue-batman-michigan-shade
File name:10fbc2c2ca8d28b393a807c6991ffa4a.exe
Download: download sample
Signature MassLogger
Create hunting rule
File size:826'368 bytes
First seen:2020-06-01 07:55:13 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 24576:B3RurAiBVYY8aHsBRI9mDW1fmqDJ7Or7x5/FD5b:BjkHJ1OqF7OHxN
Threatray 1'146 similar samples on MalwareBazaar
TLSH 9C05239932AD9D1EDB7C0D7A981040709BF389770741F2CF4FE569BA86BE3E25A00497
Reporter abuse_ch
Tags:exe MassLogger

Intelligence

File Origin
# of uploads :
1
# of downloads :
71
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-01 19:06:29 UTC
AV detection:
23 of 31 (74.19%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ums7mnxy6bdbb55l5wa7ovzzxouj7bwyajav57lhexqsoym4x4ba._file
Verdict:
malicious
Similar samples:
0ffa7ac2091ab004e6755e1e66539633b6a628e90094d80357895df0e6092f9c
MassLogger
3ab173f1c673d450f1f9640193efc87c76e64687e4c43ea0024287c875cde792
MassLogger
5b2facc5a7a9b51aad80b259535b451e25598fd154dac6d6df0820a784b6005f
MassLogger
a2c284a50d4fc05794e3bce123492bd9e547b272d9f7b87832fdc72b681580e7
MassLogger
cdf7d9b74f5f5314bb7cb771a139b12ca61bc304e1afd3f2bbaeae1d844107ea
MassLogger
d17e7aae62fd256c264b2602f913c5b918501a1416abb5c58a4f14bcafa2b0d6
MassLogger
dd487111adb26286373856649bb74a94db289cae345b2e4b1e515a1b260303f7
MassLogger
e64a8bcf44c1671d77ee091bf44aa2021c71fb8349562dcbb4c7d6d1686d1611
MassLogger
f4b3f3f1705bb5ab7ed5d0dc4bcbae09fd927a760aadbce66762d311450750b5
MassLogger
f839a819163970a1d45b5abc0eef10990dc371701cbec42b80f3c7affd7126f4
MassLogger
+ 1'136 additional samples on MalwareBazaar
Result
Malware family:
masslogger
Create hunting rule
Score:
  10/10
Tags:
family:masslogger coreentity ransomware rezer0 spyware stealer
Link:
https://tria.ge/reports/201109-d6q38b4gea/
Behaviour
Creates scheduled task(s)
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Looks up external IP address via web service
Checks computer location settings
rezer0
CoreEntity .NET Packer
MassLogger
MassLogger log file
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:masslogger_gcch
Create hunting rule
Author:govcert_ch

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

Executable exe a325f636f8f04610f7abed81f75739bba89f86d802415efd6725e127619cbf02

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments