MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a39ea4510d732392bba8682a020321dc7dfa259387244117cc90e072fea20c82. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

MassLogger

Vendor detections: 5

Intelligence 5 IOCs YARA 1 File information Comments

SHA256 hash:	a39ea4510d732392bba8682a020321dc7dfa259387244117cc90e072fea20c82
SHA3-384 hash:	6facd444a4ea5e65457bbe2a366777d19d8b8cd1684fce64b50770f1ca1d9d0e7fc3255820d721eceee1621329d7565d
SHA1 hash:	0dc6101d19d2c4a922db993be442b01200cba87e
MD5 hash:	40b83c8155808ea18beef168bea47055
humanhash:	april-pasta-shade-burger
File name:	Scan_DSV 01072020_100284001972_PDF.exe
Download:	download sample
Signature	MassLogger Create hunting rule
File size:	993'792 bytes
First seen:	2020-07-01 16:17:57 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep	12288:EFH7rxxqARmrIZ508e1E3nXuvYALS7KOItI60QaXXUBOHGvxmRrAzILmlDTpc:O7lxqAUrIZ50XEAGGZI6daXIdzSm4
Threatray	591 similar samples on MalwareBazaar
TLSH	0225F0C476B68B96EAB647F74971A80043F778BE612ED2594DC760DF81A0F004FA5B23
Reporter	abuse_ch
Tags:	exe MassLogger

abuse_ch

Malspam distributing MassLogger:

HELO: sw02.7hserver.it
Sending IP: 95.174.21.98
From: Vincenzo Pugliese <vincenzo.pugliase@it.dsv.com>
Subject: FYI
Attachment: Scan_DSV 01072020_100284001972_PDF.iso (contains "Scan_DSV 01072020_100284001972_PDF.exe")

MassLogger SMTP exfil server:
smtp.yandex.ru:587

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/17715/

Detection(s):

SecuriteInfo.com.Trojan.PWS.Siggen2.51201.31999.21341.UNOFFICIAL

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/a39ea4510d732392bba8682a020321dc7dfa259387244117cc90e072fea20c82/

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2020-07-01 16:19:05 UTC

AV detection:

24 of 29 (82.76%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=uopkiuinomrzfo5inavaeazb3r67ujmtq4secf6msdqhf7vcbsba._file

Verdict:

malicious

MassLogger

25fc942b81a074fe6b40b2f817fb87d28a54949bf604e54c414c890a351b83e4

MassLogger

2e4efd8081c1f404f225783de4e421b212cb451e9ac8202616bf6946d70151d4

MassLogger

64ac97cf73567009fd4ea4707b2c0ac2917c74842a81bddf874889d772bf9146

MassLogger

77308f79f7cb15139144f338622072fe4adab5f73debb682a349fbee8700c4ed

MassLogger

93a1f0fa0637acd096c86ec4d7d3c6f73f689bf41f3cd16b5e5bcce48dcdc540

MassLogger

9c7b335e031c3c2fde1e7d75cbe08bd0951b0cb8a327fa4bd3e54c4c59d32936

MassLogger

b74131f0e776928368dad6576cd55844d766a94605616c29a6d4b045efb6bfe6

MassLogger

c9dcd1d7470488ed72d4a673592ab0c4684124dc7e69bb903d47d6a71ffe42fd

MassLogger

e5a67f4da5b8e9ecd086bfa4f6b8e49843656d2dd8adba4840ee9cf46da3054e

MassLogger

+ 581 additional samples on MalwareBazaar

Result

Malware family:

masslogger

Score:

10/10

Tags:

ransomware spyware stealer family:masslogger

Link:

https://tria.ge/reports/200701-fhhbmaggwx/

Behaviour

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Looks up external IP address via web service

Reads user/profile data of web browsers

MassLogger log file

MassLogger

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.