MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a643a629e8acc513e9c6d51842fe1775208b64c4e1e20036fa52b7038ecf2c25. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

MassLogger

Vendor detections: 5

Intelligence 5 IOCs YARA 1 File information Comments

SHA256 hash:	a643a629e8acc513e9c6d51842fe1775208b64c4e1e20036fa52b7038ecf2c25
SHA3-384 hash:	9a1cd830c88fc9b18593d764d50cf43ec21ba8d39b4ba21ff691bd0b1a6e4d3660b85acc5f92049d15399f74b08f9104
SHA1 hash:	d1fd22f57ad0fb02f0f8ac4d31b31d2f191e0f27
MD5 hash:	db0fbf9c80238f34c22726ca4bfa6759
humanhash:	wisconsin-eighteen-emma-glucose
File name:	order.exe
Download:	download sample
Signature	MassLogger Create hunting rule
File size:	1'357'824 bytes
First seen:	2020-06-03 08:13:58 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep	24576:J0fkxKHSB1H6X4nEDTVHi0PJ7YKgynQ3kb2Kc0OrB9zztzzK:J2JH2H6InEDT1Ky9b0frB9zztzzK
Threatray	524 similar samples on MalwareBazaar
TLSH	CF559EEAF344F9DED407B8324C7C9C214453BD8E956B8267BC0B356494FA3836A6AC47
Reporter	abuse_ch
Tags:	exe geo GRC MassLogger

abuse_ch

Malspam distributing MassLogger:

HELO: pl1.azuni.net
Sending IP: 37.26.26.70
From: info@nigico.gr
Subject: Re: Σχετικά με τη νέα παραγγελία
Attachment: file.zip (contains "order.exe")

MassLogger SMTP exfil server:
smtp.gmail.com:587

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Gathering data

Threat name:

ByteCode-MSIL.Trojan.Genkryptik

Status:

Malicious

First seen:

2020-06-03 10:35:52 UTC

AV detection:

18 of 31 (58.06%)

Threat level:

2/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=uzb2mkpivtcrh2og2umef7qxouqiwzge4hraanx2kk3qhdwpfqsq._file

Verdict:

malicious

MassLogger

17f689baa181d9587a0adfa8889242c0cb3f563cf5644c20dc7738e86f8ae9b7

MassLogger

291acc1800bb543e73f85a5ec925fba62d9af86f75091fd7993c20d4fe78e22c

MassLogger

4fd457b5e2ff2430dbce5692ba6c47253ade9e105ffb192d01aee29d6ba7c912

MassLogger

7f2a8610931a1f5ff9793dcb854ca01aaa6410fb5b4dc287753c558f1b60eee1

MassLogger

b3a68a5f2b68c4d0bb8d440144a968a680c954976bfeec54ae8074f616c0aded

MassLogger

bd72223afa837379fe320c88e0c18d6bffaa463615b4d68c1afbfd3bac4f5f93

MassLogger

c4daccf0ac446a6160b18ea3fbf9ab3166ee4181c0e9a40d1c7f26702dea5a69

MassLogger

ed02a2653566d5a67a9b1863d02ed672b1947a6566cc61464f0d7a24ea335074

MassLogger

f6853a25abff371818a7a5852ecaf8b01482577e3f2a4eb1ca2093b739d1601c

MassLogger

+ 514 additional samples on MalwareBazaar

Result

Malware family:

masslogger

Score:

10/10

Tags:

family:masslogger coreentity ransomware rezer0 spyware stealer

Link:

https://tria.ge/reports/201109-yamghzbdfs/

Behaviour

Creates scheduled task(s)

Suspicious behavior: AddClipboardFormatListener

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Looks up external IP address via web service

Checks computer location settings

Reads user/profile data of web browsers

rezer0

CoreEntity .NET Packer

MassLogger

MassLogger Main Payload

MassLogger log file

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.