MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d7269fff7321b7254a2a6ce7e6fb9b8347d73cb78597d73412b8d21344832e81. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 7


Intelligence 7 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d7269fff7321b7254a2a6ce7e6fb9b8347d73cb78597d73412b8d21344832e81
SHA3-384 hash: adc5b8e6067fa5c6ddbc8b8e7b70137a1ad7ae6e189ae37b681fe7a713e97eab082ca6459b5bb7949c368e42097467be
SHA1 hash: 6baef77aa43f56c23aa48b19ee7acec0f27213ec
MD5 hash: c4eb73549663f5a0925826350281a9f7
humanhash: fruit-video-vegan-alaska
File name:Purchase Order.exe
Download: download sample
Signature MassLogger
Create hunting rule
File size:1'022'464 bytes
First seen:2020-07-24 12:40:38 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 24576:p/z13q+/yiGMvo7AG43SL70ow7DEyfQ9sr4K2vCEe:pL16+/yzV7RiSL7fl9c4Kn
Threatray 674 similar samples on MalwareBazaar
TLSH FF25AC47DFB819FAEB7457BFD40144458678882A83C6E3853B5FF0A56C76E608B13CA2
Reporter jarumlus
Tags:MassLogger

Intelligence

File Origin
# of uploads :
1
# of downloads :
92
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/32197/
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %AppData% directory
Creating a file in the %temp% directory
Launching a process
Creating a process with a hidden window
Deleting a recently created file
Unauthorized injection to a recently created process
Creating a file
Sending an HTTP GET request
Using the Windows Management Instrumentation requests
Reading Telegram data
Reading critical registry keys
Moving a file to the %temp% directory
Enabling autorun with Startup directory
Result
Threat name:
MassLogger RAT
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/397382
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d7269fff7321b7254a2a6ce7e6fb9b8347d73cb78597d73412b8d21344832e81/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-24 00:55:52 UTC
AV detection:
25 of 29 (86.21%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=24tj773teg3sksrkntt6n643qnd5opfxqwl5onasxdjbgredf2aq._file
Verdict:
unknown
Similar samples:
21d61e01077c5b12aa0ad5918b74c6cafce983290adc3311c3a89d849287357d
MassLogger
415ceff1ef1fa3bfc448613f3f6cc2435051f49ed8961b1cab030d75ee8bd65f
MassLogger
420da876f8efdf70da0ec0ccd1b7aaa09547b6868d5fc655c05b50eadf20c360
MassLogger
72bc51445d960d638c96f46057b76b5200ed88009ef44d767e870e56d7c562aa
MassLogger
84321d91850ce025e214ab49400d8c1fade931a55483a87582f4f266e3ec196b
MassLogger
945ececcb2fd0b7d3a4fd86464737752ba8c1cf215159868595bd9d167a337a2
MassLogger
9de5e8e2d7733dfcf568e5b11a95d2468ef905e90169d7a4c93e1909a0372f04
MassLogger
cc1bbef42692db18e756a3d2498f59fbfcaacaf32c38f2a4e6a5cf1a6b4c67a1
MassLogger
cfbf8e9c3e178d14a8afa864eacdf5e9ee57c82679b08bbceb56ca418c86e908
MassLogger
d51f21ff25f795d8e35ceee54a3e2e46183f46eee6ba3f9fe2cf94893ef6bc63
MassLogger
+ 664 additional samples on MalwareBazaar
Result
Malware family:
masslogger
Create hunting rule
Score:
  10/10
Tags:
ransomware stealer spyware family:masslogger
Link:
https://tria.ge/reports/200724-62khxxkpsn/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Creates scheduled task(s)
Suspicious use of SetThreadContext
Looks up external IP address via web service
Reads user/profile data of web browsers
MassLogger log file
MassLogger
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Farheyt
Score:
0.80
Link:
https://yomi.yoroi.company/submissions/d7269fff7321b7254a2a6ce7e6fb9b8347d73cb78597d73412b8d21344832e81

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:masslogger_gcch
Create hunting rule
Author:govcert_ch
Rule name:win_masslogger_w0
Create hunting rule
Author:govcert_ch

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

zip c74b4236eb38d0bf5d1fe43ab575879f4cf81d498250ecfcb1926bb519f77d18

MassLogger

Executable exe d7269fff7321b7254a2a6ce7e6fb9b8347d73cb78597d73412b8d21344832e81

(this sample)

  
Dropped by
MD5 b193a3dda86956225f21a4bf60e51686
  
Dropped by
SHA256 c74b4236eb38d0bf5d1fe43ab575879f4cf81d498250ecfcb1926bb519f77d18
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/32197/

Comments