MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e7acb91c1fe721b5a2cb5dcae27e69d1ce575cf19a0d929fe6b6ff9b81ebdf9b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 4


Intelligence 4 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e7acb91c1fe721b5a2cb5dcae27e69d1ce575cf19a0d929fe6b6ff9b81ebdf9b
SHA3-384 hash: 6e6a9282960d7cd6664be50cb04765a978c11ef3de26d0c4eb5709c45b01aa674b9c4ca2c908da341adc4fd7fd945434
SHA1 hash: a0e184e3f49bc7ea55d19b3ad698cb12fe05f517
MD5 hash: c55134b50627719ad8526757721e3146
humanhash: mango-ten-pennsylvania-bravo
File name:Purchase order from Innovix Distribution_pdf.exe
Download: download sample
Signature MassLogger
Create hunting rule
File size:1'092'608 bytes
First seen:2020-06-29 12:33:44 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:3rs1WBsejpS7oTO5VeoCAsww55S+U96pKHt0BZL3kTGP2NG7J2z8u:A1WjpS7oa5VDC5ww5k+NS2L2NgQz8u
Threatray 2'393 similar samples on MalwareBazaar
TLSH E7356C403FB09C13E89A01B054147E8B1D7DA943E4D5E26BBB723AD165729BFE5B8C0E
Reporter abuse_ch
Tags:exe MassLogger


Avatar
abuse_ch
Malspam distributing MassLogger:

HELO: slot0.meplesci.com
Sending IP: 45.95.169.70
From: ''Eric Wang''<info@meplesci.com>
Reply-To: info@meplesci.com
Subject: REQUEST FOR QUOTATION - NO: 792-286
Attachment: Purchase order from Innovix Distribution_pdf.rar (contains "Purchase order from Innovix Distribution_pdf.exe")

MassLogger SMTP exfil server:
mail.mytravelexplorer.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
74
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/16277/
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e7acb91c1fe721b5a2cb5dcae27e69d1ce575cf19a0d929fe6b6ff9b81ebdf9b/
Threat name:
Win32.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-29 12:35:09 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=46wlsha744q3liwllxfoe7tj2hhfoxhrtigzfh7gw37zxapl36nq._file
Verdict:
suspicious
Similar samples:
1e6d5a6bbf1f99d4fa6407fa70c5efbed9a7cd1486085c4bb6b213753bb0dbfe
MassLogger
45808d9b0a58982e3bddb4e711f25d5224ad78165fbeb24b1a720358679bcbc3
MassLogger
46fcd198aa60c5510e6afb60b7ca8db803fd876fdbdda5b92481d52d105d1c28
MassLogger
48911ded8eb1be557009ec74a427c92481389c32e01c8a1c8935aa8db52bb558
MassLogger
48cad358250f70cffecaed785f4d128f48174adc0ee5948e00ab1b6ffbef803c
MassLogger
73909b3dbd65e3694a5d97988dd78b7c348c30a462344cd5c79a181a4d64c2a4
MassLogger
7c8962ad0cf0487df0793c34b8bba9b9fbb83e88287afa9761083e3d7b4eda36
MassLogger
abe23e12f4aa1f3e0b9ea3777ffaaf4fdcf9ccb21e7331b32d20bfa3a511f6c7
MassLogger
b434ee9215f7c5eb168be08da0470032f1fa75f16d41557fe958e55623bac26e
MassLogger
ddb56cadf564aac028ed312fb7ddb378d1951c2c8ed1a12e43f7e92d29843a08
MassLogger
+ 2'383 additional samples on MalwareBazaar
Result
Malware family:
masslogger
Create hunting rule
Score:
  10/10
Tags:
ransomware spyware stealer family:masslogger
Link:
https://tria.ge/reports/200629-59tkpgtpbe/
Behaviour
Suspicious behavior: AddClipboardFormatListener
Creates scheduled task(s)
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Suspicious use of SetThreadContext
Looks up external IP address via web service
Reads user/profile data of web browsers
MassLogger
MassLogger log file
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:masslogger_gcch
Create hunting rule
Author:govcert_ch

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

rar f17eab7c6b86f2cbd0ef8ecab18cbbdd5ed2f6bec2bd99362c4746c859195ecd

MassLogger

Executable exe e7acb91c1fe721b5a2cb5dcae27e69d1ce575cf19a0d929fe6b6ff9b81ebdf9b

(this sample)

  
Dropped by
MD5 a4278e6976f4b6672191a9abed73aae3
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 f17eab7c6b86f2cbd0ef8ecab18cbbdd5ed2f6bec2bd99362c4746c859195ecd
Cape
Cape
https://www.capesandbox.com/analysis/16277/

Comments