MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cc9cd3fab00a7ca68c26cbf9bfcf691aafd004232149c04d2d082a1fe06b9f32. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

MassLogger

Vendor detections: 5

Intelligence 5 IOCs YARA 1 File information Comments

SHA256 hash:	cc9cd3fab00a7ca68c26cbf9bfcf691aafd004232149c04d2d082a1fe06b9f32
SHA3-384 hash:	c14e506c3cf11ed1bc50c625523f3fe3772ce21c37194078f8ffdf459aaf68c66310c7f804cbca586a65ba323408cf86
SHA1 hash:	269592ed330417b87d325174e1a6ae180b0a4243
MD5 hash:	6113ddc1b5a8d0984b259768fa03a681
humanhash:	bluebird-nine-rugby-early
File name:	AOS Neptune_028E.exe
Download:	download sample
Signature	MassLogger Create hunting rule
File size:	888'832 bytes
First seen:	2020-06-11 05:54:26 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep	12288:hiZuhpFnqI+im1u+0AlphaNOxwi+6ssv+SduKLXNbt3w0QdBTUJpTg+v2lLCM9BA:hThpFHI1hpeTPa+0LXI04kTgzhCM
Threatray	523 similar samples on MalwareBazaar
TLSH	141523906AF9C732D4AD52FC84622A4013307D6A6A33FF495EC4F0EF56937664394A2F
Reporter	abuse_ch
Tags:	exe MassLogger

abuse_ch

Malspam distributing MassLogger:

HELO: jfcaust.com.au
Sending IP: 37.49.224.121
From: ORDER MEL(Eiko) <order.mel@jfcaust.com.au>
Subject: Inquiry_AOS Neptune_028E
Attachment: AOS Neptune_028E.iso (contains "AOS Neptune_028E.exe")

MassLogger SMTP exfil server:
mail.privateemail.com:587

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/8879/

Detection(s):

SecuriteInfo.com.BehavesLike.Win32.Generic.cc.22149.UNOFFICIAL

Gathering data

Threat name:

ByteCode-MSIL.Trojan.FormBook

Status:

Malicious

First seen:

2020-06-11 05:56:11 UTC

AV detection:

24 of 31 (77.42%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=zsonh6vqbj6kndbgzp437t3jdkx5abbdefe4atjnbavb7ydlt4za._file

Verdict:

malicious

MassLogger

1d4b91dc88ea2559572438fe3b57c6449bb5e0a66c9f3f9e90a22393caf5d30c

MassLogger

5205f5e4d159f32f819aac8c870fffb7612b13c0a0d12236730743b9239251df

MassLogger

b07fc0cda6cbe5231e96b4a53ff2519f6531bc048e9bede988fdaa94fb1a3863

MassLogger

b186287c6298b4ca285cb9da1e82ffd351c4195f7673d93aa595aa987cb01676

MassLogger

bcbc247fa3511376777587035868c9a0f8fda850fa5f7d84c81fa5de905bc0d6

MassLogger

c166a4a1899462e20516825c87f9545cdc7b24654d1f18b864da4ee641af5ace

MassLogger

d1cd1dfe3657445da551255b38ae6eab649729dde0bf68a3df112c4059855df4

MassLogger

e1a319fa7beb45eb37027f911eaf5b74840319f5dafecde1a4e6c201aa0ea46d

MassLogger

ebb0640f2e9c9893b4dee06e69dc547e19570980e94eaacb0b4e77436966cd0d

MassLogger

+ 513 additional samples on MalwareBazaar

Result

Malware family:

masslogger

Score:

10/10

Tags:

family:masslogger ransomware rezer0 spyware stealer

Link:

https://tria.ge/reports/201109-mcvp1x7hya/

Behaviour

Suspicious behavior: AddClipboardFormatListener

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Looks up external IP address via web service

Checks computer location settings

Reads user/profile data of web browsers

rezer0

MassLogger

MassLogger Main Payload

MassLogger log file

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.