MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f0176393025bb51cbf9ac3e0d457ab89e129d90583fa103ff9db794687787715. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

MassLogger

Vendor detections: 4

Intelligence 4 IOCs YARA 1 File information Comments

SHA256 hash:	f0176393025bb51cbf9ac3e0d457ab89e129d90583fa103ff9db794687787715
SHA3-384 hash:	cc600403e1bfb87465e4d8ab9bc64a277c4cdae3ee384326369e4a69464329b25cef66319fa5dc72b7a2dbdb3ad1d590
SHA1 hash:	6aabb9ad9424b5be363fed86ad528b190a9bcc24
MD5 hash:	fcada174c3065750b2fbf81594987216
humanhash:	uniform-oregon-fanta-magnesium
File name:	Oypy7XYBTMuI7M2.exe
Download:	download sample
Signature	MassLogger Create hunting rule
File size:	718'848 bytes
First seen:	2020-06-24 06:57:30 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep	12288:8dBY9IhYtu4+rNMfwYkSp0s0q7NtHVQzZP7llxMiiSA/NB7apoTslFd3q3:2NTSp0BqRtHGzfAb7CoglFd3y
Threatray	873 similar samples on MalwareBazaar
TLSH	0FE4121B7B9CB61BCA7414F988C04B8863B669AAF141F7D97D8036ED2DC7BE205201C7
Reporter	abuse_ch
Tags:	exe HostGator MassLogger

abuse_ch

Malspam distributing MassLogger:

HELO: qproxy5-pub.mail.unifiedlayer.com
Sending IP: 69.89.21.30
From: AMIGO Tech Industries <supertechfc@gmail.com>
Subject: RE: RFQ 60 MT SI#AC2019-0327
Attachment: RFQ_ NEW ORDER 5768.rar (contains "Oypy7XYBTMuI7M2.exe")

MassLogger SMTP exfil email address:
mail.privateemail.com:587

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/13521/

Detection(s):

SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f0176393025bb51cbf9ac3e0d457ab89e129d90583fa103ff9db794687787715/

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2020-06-24 06:59:04 UTC

AV detection:

24 of 31 (77.42%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=6alwheyclo2rzp42ypqniv5lrhqstwifqp5bap7z3n4unb3yo4kq._file

Verdict:

unknown

MassLogger

033bf801cc1629f11843d56abc90a50768946cc207e0bdfb6d268ec073bf2a78

MassLogger

2cf0748f853ea89cc9573f7b6f3c6edeab4e4a6611ef5ea33320da6eaa8aac3d

MassLogger

69e1a15be2f6adc6268ec617568b3d2725122eb8d34873c23a7117b24e8b6854

MassLogger

7ce1d1ee1151f6afdcba77604444c9a5c46b2787131658b4cb6174336e96e11d

MassLogger

7dfe5d9e3e099285a3bc63497d1ee47ac99b7012f23beb730d73557b40afa26c

MassLogger

a9316a887a00dbf992833394b7a4e05db6e6e6929f66419a06ebbccf358e45b4

MassLogger

b8214924a598b9fd3193099fecd6c3d09f06dc5e3a9af098642c7d5327c05cd3

MassLogger

ba3b49260d4a7b2777b3fc983d532144bc7bab77e35f2608bbdc2854ab7a31d0

MassLogger

bc02f7f4317f67dcc9ef60b524498431ec0ef0b261f715c4b20371e423b30fb5

MassLogger

+ 863 additional samples on MalwareBazaar

Result

Malware family:

masslogger

Score:

10/10

Tags:

ransomware spyware stealer family:masslogger

Link:

https://tria.ge/reports/200624-fydfp4bb4e/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

Creates scheduled task(s)

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: AddClipboardFormatListener

Suspicious use of SetThreadContext

Looks up external IP address via web service

Reads user/profile data of web browsers

MassLogger

MassLogger log file

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.