MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dccd0903a7912382f20b16beb29d93c14435e41ee655c2e88740879089d56fca. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Intelligence File information Yara 2 Comments

SHA256 hash: dccd0903a7912382f20b16beb29d93c14435e41ee655c2e88740879089d56fca
SHA3-384 hash: 9aa94d7becf287d89f6477838aafd2b90ffc221bc1768f9c359b3a87a051a707aab3329a1d7772df3e0d9dc79f87bbea
SHA1 hash: 64540d461fb9bfedeaf9df200c960970bea164fd
MD5 hash: 618c581392b7271abdf40a8b376e8324
humanhash: mirror-connecticut-batman-cold
File name:INQUIRY No. 310720205467_pdf.exe
Download: download sample
Signature MassLogger
File size:1'248'768 bytes
First seen:2020-07-31 12:16:46 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744
ssdeep 12288:jHX8kTy215h0nDiDVi1k71ThB5TldBTI4SvZNGQRqtsWY3zqm:jHLTy6h0nDiDU1k71l1SOgqyWGO
TLSH CB45F6367A928414C91D2A75C0B85DC1B7B5768A3B92DB0F709A13486E033EFBB4716F
Reporter @abuse_ch
Tags:exe MassLogger


Twitter
@abuse_ch
Malspam distributing MassLogger:

HELO: electronics.local
Sending IP: 103.1.12.68
From: Rodrigo Peralta <rperalta@llorente.cl>
Reply-To: Rodrigo Peralta <soomla6384@yahoo.com>
Subject: AW: AW: Inquiry
Attachment: INQUIRY No. 310720205467_pdf.7z (contains "INQUIRY No. 310720205467_pdf.exe")

Intelligence


File Origin
# of uploads :
1
# of downloads :
37
Origin country :
FR FR
Mail intelligence
Geo location:
Global
Volume:
Low
Vendor Threat Intelligence
Result
Threat name:
MassLogger RAT
Detection:
malicious
Classification:
troj.evad
Score:
72 / 100
Signature
.NET source code contains very large array initializations
Deletes itself after installation
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected MassLogger RAT
Behaviour
Behavior Graph:
behaviorgraph top1 signatures2 2 Behavior Graph ID: 255372 Sample: INQUIRY No. 310720205467_pdf.exe Startdate: 31/07/2020 Architecture: WINDOWS Score: 72 20 Yara detected MassLogger RAT 2->20 22 .NET source code contains very large array initializations 2->22 24 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 2->24 26 2 other signatures 2->26 8 INQUIRY No. 310720205467_pdf.exe 3 2->8         started        process3 signatures4 28 Injects a PE file into a foreign processes 8->28 11 INQUIRY No. 310720205467_pdf.exe 3 8->11         started        process5 process6 13 cmd.exe 1 11->13         started        process7 15 powershell.exe 17 13->15         started        18 conhost.exe 13->18         started        signatures8 30 Deletes itself after installation 15->30
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Status:
Malicious
First seen:
2020-07-31 12:18:10 UTC
AV detection:
15 of 31 (48.39%)
Threat level
  5/5
Result
Malware family:
masslogger
Score:
  10/10
Tags:
ransomware stealer spyware family:masslogger
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious behavior: AddClipboardFormatListener
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Looks up external IP address via web service
Reads user/profile data of web browsers
MassLogger log file
MassLogger
Threat name:
Malicious File
Score:
1.00

Yara Signatures


Rule name:masslogger_gcch
Author:govcert_ch
Rule name:win_masslogger_w0
Author:govcert_ch

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

Executable exe dccd0903a7912382f20b16beb29d93c14435e41ee655c2e88740879089d56fca

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments