MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d9d166ad30417f3158f7228c54985f97fe502523f910f14fbc5f7fb729c85e56. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d9d166ad30417f3158f7228c54985f97fe502523f910f14fbc5f7fb729c85e56
SHA3-384 hash: 4ccf8db491b8ee5a5ad11174bb645268619a4169526e390dbc74a415030df02ebe86ea4ed77ba44aec426f18e1d1b8c6
SHA1 hash: 8927d23ba66bd8ea03dee816e48186a137eee5ca
MD5 hash: 980f255124311d6d9a3b2854badb133c
humanhash: yankee-angel-zulu-seven
File name:bank_swift_U15789467HDG.exe
Download: download sample
Signature MassLogger
Create hunting rule
File size:2'112'512 bytes
First seen:2020-06-08 06:58:39 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 3d95adbf13bbe79dc24dccb401c12091 (881 x AgentTesla, 737 x FormBook, 236 x SnakeKeylogger)
ssdeep 49152:OVg5tQ7a63Ismk68Kj4IRS/x6SGzYhY5:wg56FdC9u/GzY
Threatray 946 similar samples on MalwareBazaar
TLSH 11A5E02323DD8365C37E5173BA1577016EBBF82506A1F4BB2FA4C93CA9201215E1E66F
Reporter abuse_ch
Tags:exe MassLogger


Avatar
abuse_ch
Malspam distributing MassLogger:

HELO: rakco.com.sa
Sending IP: 45.138.172.165
From: Kazem Al-Sharif<haitamaltaweel@rakco.com.sa>
Subject: Payment transfer/bank swift
Attachment: bank_swift_U15789467HDG.iso (contains "bank_swift_U15789467HDG.exe")

MassLogger SMTP exfil server:
mail.protenginstalacoes.com.br:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27686.AidExe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.PSW.Agent.BORA.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-06-08 02:23:06 UTC
AV detection:
27 of 29 (93.10%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3hiwnljqif7tcwhxekgfjgc7s77fajjd7eipct54l573okoilzla._file
Verdict:
malicious
Similar samples:
06bdfeb06913135fc27119ebf2c896d2ff3d30e05a1cbd53ad1d0f632a4fba46
MassLogger
0a44ee4a63f01378570de7668ee2daa17534d296a6ff2c45bc14d8f9b07bb837
MassLogger
136c0ea1bd536ac388d809f3d1f7c01be867a72a77b6b71df7b2d04ae21e3064
MassLogger
14fd527270413bbe03889b5082000818055ae981fd2ea0df41f24ff34c7c4621
MassLogger
2929bd7e338ae0270746e4b60faa44c0f5d3d34c4d166964ce013100bafbf1a3
MassLogger
43c22ad8da4c7b3702e70d5c97e7ceed85a50dbd7926fccc5eda0bd775fcec51
MassLogger
48f69c4f0432c9552fff3e4bd5274751ecd529365ccee42c7a3b5f3bbc83ffe5
MassLogger
786b5266ae016683f13abe07cb1e99c01b2d617d3ca7518da086571d9f158d1b
MassLogger
cca90e3d9da209fea67333dafd2d7882f498f1c0023432f0ab6f05a3ca430b19
MassLogger
db183fbb41e6ac88f64e72c8b5b21ff971530789ff2ff1df1f5a8d8827b4ded6
MassLogger
+ 936 additional samples on MalwareBazaar
Result
Malware family:
masslogger
Create hunting rule
Score:
  10/10
Tags:
family:masslogger ransomware spyware stealer
Link:
https://tria.ge/reports/201109-2nrz5kjb1n/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Looks up external IP address via web service
Deletes itself
Reads user/profile data of web browsers
MassLogger
MassLogger Main Payload
MassLogger log file
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:masslogger_gcch
Create hunting rule
Author:govcert_ch

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

iso 714a0e429dacb17ab2c03459024881547a8a36a76962f9869a72810f0e5bfbe9

MassLogger

Executable exe d9d166ad30417f3158f7228c54985f97fe502523f910f14fbc5f7fb729c85e56

(this sample)

  
Dropped by
MD5 1c8e744306406e20928ab8996018a057
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 714a0e429dacb17ab2c03459024881547a8a36a76962f9869a72810f0e5bfbe9

Comments