MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c4a07dc8bc6223598106bdc7ad462c050f7da18c2756fccc8c56d14b1c2bd04c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

MassLogger

Vendor detections: 5

Intelligence 5 IOCs YARA 1 File information Comments

SHA256 hash:	c4a07dc8bc6223598106bdc7ad462c050f7da18c2756fccc8c56d14b1c2bd04c
SHA3-384 hash:	5a0dd44d26c6724e92412a4a0be57a97c29debaec5979fa7199f32d382f4834eb3a0d7525ad16a0e4c007f9ca80ec3d3
SHA1 hash:	3a56f6e47b85c73e3d5318b369a1f731b76ea177
MD5 hash:	31e4fd5f285426f12f9797ed344358d4
humanhash:	lake-enemy-california-venus
File name:	Order.exe
Download:	download sample
Signature	MassLogger Create hunting rule
File size:	986'112 bytes
First seen:	2020-06-10 11:40:32 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep	24576:9xv68+Fl518jgUbvCmzAbo65RX2FDCEAP6J8j3N69+W1ug:Lv/+Dmg6vC4QBO/Dijd6l
Threatray	5'371 similar samples on MalwareBazaar
TLSH	A425F199325071AFC82BD87699E82C60AB6174B7932BD303A45716ED9E0D7D7CF006E3
Reporter	abuse_ch
Tags:	exe geo MassLogger TUR

abuse_ch

Malspam distributing MassLogger:

HELO: pl1.azuni.net
Sending IP: 37.26.26.70
From: info@tsmglobal.com.tr
Subject: Re: Yeni sipariş,
Attachment: List of new order.zip (contains "Order.exe")

MassLogger C2:
http://bestemys.com/cgi/ddssf4-40wsdd5-c5ae87-d59224-bc555d-d2379d-26222db-3152322/upload.php

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Gathering data

Threat name:

ByteCode-MSIL.Trojan.Kryptik

Status:

Malicious

First seen:

2020-06-10 11:42:14 UTC

AV detection:

28 of 31 (90.32%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=ysqh3sf4mirvtaigxxd22rrmauhx3imme5lpztemk3iuwhbl2bga._file

Verdict:

malicious

MassLogger

3142e234938b7d0d3bccb3faada5555b00f9e5d8fe9fc7dba7efe07ae03e4d99

MassLogger

6a47bf03b1ffebac3ef5497af7d67aa562f3c401c3694d8551f7092f7f469313

MassLogger

7f2a8610931a1f5ff9793dcb854ca01aaa6410fb5b4dc287753c558f1b60eee1

MassLogger

98f14edea3c84946787d020e97f6b161cae2ed419e458434413626b9893c6f62

MassLogger

b2252d785f2e382426f925f27ae6cc491dec145159e23992098c1a70c87cea8f

MassLogger

cbaf28d8fb7addec023228bbdd6a5062e875070bc16452c15515792b78855000

MassLogger

d9b75b8d542d8278b8748169b3250cdf07604dc91e9d5c5a5686727d9f58afb7

MassLogger

df2bbdd833be8896f46c8660acfc9da2711f2a75d8338240b781fc6ee3964f9e

MassLogger

f38f1e2f50b3e3efde74f70cf0fe4f264ebe5ddcb0d55cadc61776b12036ad68

MassLogger

+ 5'361 additional samples on MalwareBazaar

Result

Malware family:

masslogger

Score:

10/10

Tags:

family:masslogger evasion ransomware rezer0 spyware stealer

Link:

https://tria.ge/reports/201109-2c3bpmfpbs/

Behaviour

Creates scheduled task(s)

Suspicious behavior: AddClipboardFormatListener

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Looks up external IP address via web service

Checks computer location settings

Reads user/profile data of web browsers

ServiceHost packer

rezer0

MassLogger

MassLogger Main Payload

MassLogger log file

Modifies visibility of file extensions in Explorer

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.