MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c4349d30167ec1dfd9c70454c3f91a5ac21d52d433c093391462bc3f995e7781. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

MassLogger

Vendor detections: 5

Intelligence 5 IOCs YARA 1 File information Comments

SHA256 hash:	c4349d30167ec1dfd9c70454c3f91a5ac21d52d433c093391462bc3f995e7781
SHA3-384 hash:	64ddd243b803b5be937b95de7b730d279aa7f6a7fce7894f50eefd7554b938202953cdadf0461c0541140df7cbc68bfc
SHA1 hash:	5a57f3abe3e6105207ece6f3fd1e830e2c341868
MD5 hash:	7e3ce66bf8cca74b5a5339d9f2b8aeeb
humanhash:	comet-don-ack-shade
File name:	Scan_DSV_03072020_038465318631_PDF.exe
Download:	download sample
Signature	MassLogger Create hunting rule
File size:	839'680 bytes
First seen:	2020-07-03 06:49:34 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep	12288:8GuYs3K8qqJfBPCqTkQHB/3W98R/II6Kr2dZ3JxUQhujsshpi35irWB07BdWk:N185JBC8/fr2z3JQ7aE7
Threatray	688 similar samples on MalwareBazaar
TLSH	D00512342388FE75D46E4ABCB14020210F397523AE12E3E57EC461E373DB7999F52A96
Reporter	abuse_ch
Tags:	exe MassLogger

abuse_ch

Malspam distributing MassLogger:

HELO: m5-mail6.ewake.it
Sending IP: 109.74.204.176
From: Vincenzo Pugliese <vincenzo.pugliase@it.dsv.com>
Subject: FYI
Attachment: Scan_DSV_03072020_038465318631_PDF.iso (contains "Scan_DSV_03072020_038465318631_PDF.exe")

MassLogger SMTP exfil server:
smtp.yandex.ru:587

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Gathering data

Detection(s):

SecuriteInfo.com.Generic-EXE.UNOFFICIAL

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/c4349d30167ec1dfd9c70454c3f91a5ac21d52d433c093391462bc3f995e7781/

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2020-07-03 06:51:06 UTC

AV detection:

22 of 29 (75.86%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=yq2j2mawp3a57woharkmh6i2llbb2uwugpajgoiumk6d7gk6o6aq._file

Verdict:

malicious

MassLogger

1b96f8cd03f8c2920ec5ea6e1ea5402968e7a148da59e38991890eefbe76a19d

MassLogger

31ddfa7fc38acfe4d73b8e927044146f9d4a129ff94e34736743087db398b694

MassLogger

3a85cb51540571b98adc8edbe330bf0169582553a2c3bdb81171ebb5761ae001

MassLogger

55b1958cad02798ab8e4c0b112eb874e8e5e33d860038a88be8a5a43fc034ae8

MassLogger

608c72464a4e7119e194ce6aebd289fcbfd82fc4111fe67514acb1fccb1ff574

MassLogger

6e22db1834ae73d97439fa86fb6c7ab3c113455373e7d06968e4aaa2c7ef50b0

MassLogger

7e92197ddb0e07047c78c4965ac68b3edefebdc1bdda6033ac06a1f1585ba335

MassLogger

aa295e2d42302ebe15c2f974208d0201b7fd2de16d4145dec27c0201b9062c55

MassLogger

cf902bef4285e284b94b032a1636f481cfc64cece90489b6055c7227536bbaa5

MassLogger

+ 678 additional samples on MalwareBazaar

Result

Malware family:

masslogger

Score:

10/10

Tags:

ransomware stealer spyware family:masslogger

Link:

https://tria.ge/reports/200703-kk92m5rh5s/

Behaviour

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Looks up external IP address via web service

Reads user/profile data of web browsers

MassLogger log file

MassLogger

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.