MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e64a8bcf44c1671d77ee091bf44aa2021c71fb8349562dcbb4c7d6d1686d1611. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e64a8bcf44c1671d77ee091bf44aa2021c71fb8349562dcbb4c7d6d1686d1611
SHA3-384 hash: b5c79c47a0ff2955d68d91dd6f458d1bd3c45d276c0aced0e9c2b83d6cee0709e3801e2ec28bca3d6aaa71c47f370f8f
SHA1 hash: 48a5f222470d4525c80b8ffbd426deea63674284
MD5 hash: 6439abd7b4c1b488020e75ab69953823
humanhash: blossom-muppet-vermont-lamp
File name:Quote.exe
Download: download sample
Signature MassLogger
Create hunting rule
File size:838'656 bytes
First seen:2020-06-30 12:24:00 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 24576:voEdnf0AvMgj1VNZTh8/ovwrAt3A6zoCgtmoD:v7Nz9DNZ9covwE1A6sCgUoD
Threatray 552 similar samples on MalwareBazaar
TLSH 630522313A78AB2DC9B9877212B110150FF1FA2F8531E72E5E90D6C72977B90C601EA7
Reporter abuse_ch
Tags:exe MassLogger


Avatar
abuse_ch
Malspam distributing MassLogger:

HELO: kangkeusa.com
Sending IP: 161.129.67.231
From: Mr Brian Plose <info@kangkeusa.com>
Subject: Quote
Attachment: Quote.exe

MassLogger SMTP exfil server:
us2.smtp.mailhostbox.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
70
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/17131/
Detection(s):
SecuriteInfo.com.Generic-EXE.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e64a8bcf44c1671d77ee091bf44aa2021c71fb8349562dcbb4c7d6d1686d1611/
Threat name:
ByteCode-MSIL.Backdoor.NanoCore
Create hunting rule
Status:
Malicious
First seen:
2020-06-30 12:25:04 UTC
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4zfixt2eyftr257oben7isvcaiohd64djflc3s5uy7lnc2dncyiq._file
Verdict:
malicious
Similar samples:
0ffa7ac2091ab004e6755e1e66539633b6a628e90094d80357895df0e6092f9c
MassLogger
112d707367a7101031fb617c9514187ca68b817a27b6b6a2ecc1b737dc974a1a
MassLogger
3ab173f1c673d450f1f9640193efc87c76e64687e4c43ea0024287c875cde792
MassLogger
4d47d2e29b7056f1d96947436ffc1eb030102f1b4b949d7708d33e77a321a831
MassLogger
5b2facc5a7a9b51aad80b259535b451e25598fd154dac6d6df0820a784b6005f
MassLogger
67a5b58d36ef0884ee86d601a72ffb085c02aa9cfa40cd3a869ea6806084a011
MassLogger
79a191033da8c7040b19ef97042dcef88669f15b784d881cbb5b8ace51cf26ce
MassLogger
a97835df055504850909bdb785d2bd535cc22702f418147cc3af6d4add370a59
MassLogger
aadeefdff2d2e15548eebcc0d510784f7ba79aaeee9615b3705f30b60b352e5b
MassLogger
f839a819163970a1d45b5abc0eef10990dc371701cbec42b80f3c7affd7126f4
MassLogger
+ 542 additional samples on MalwareBazaar
Result
Malware family:
masslogger
Create hunting rule
Score:
  10/10
Tags:
ransomware spyware stealer family:masslogger
Link:
https://tria.ge/reports/200630-57y3knbcla/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: AddClipboardFormatListener
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Suspicious use of SetWindowsHookEx
Suspicious use of SetThreadContext
Looks up external IP address via web service
Reads user/profile data of web browsers
MassLogger log file
MassLogger
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:masslogger_gcch
Create hunting rule
Author:govcert_ch

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

Executable exe e64a8bcf44c1671d77ee091bf44aa2021c71fb8349562dcbb4c7d6d1686d1611

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/17131/

Comments