MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f38f1e2f50b3e3efde74f70cf0fe4f264ebe5ddcb0d55cadc61776b12036ad68. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f38f1e2f50b3e3efde74f70cf0fe4f264ebe5ddcb0d55cadc61776b12036ad68
SHA3-384 hash: f4516927c9597b0363a626bcbf9eb570eb7750d9c1627837dc01342758d347f49519e531a2d1dfb785aca20236b7b512
SHA1 hash: 0f33cb7543cf0610c8b2d1b291bb350f4ea4c56c
MD5 hash: 5c91f4a381a487570a0eba1b941ebfb0
humanhash: ohio-early-uncle-sierra
File name:DHL.TRACKING.PDF.exe
Download: download sample
Signature MassLogger
Create hunting rule
File size:963'584 bytes
First seen:2020-06-10 07:22:55 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 24576:WDv68++VCFYa7FiYM5RO3R1M3go3LLMpLZ:0v/++VQY+FiYqOEOL
Threatray 6'631 similar samples on MalwareBazaar
TLSH BA25F1893254B69FC82BDD72C9982C249B6064B79327D743644711EDAD0EBDBCF052E3
Reporter abuse_ch
Tags:DHL exe MassLogger


Avatar
abuse_ch
Malspam distributing MassLogger:

HELO: server.philembassycairo.org
Sending IP: 195.154.38.153
From: DHL EXPRESS INTERNATIONAL <administracion@conectachile.cl>
Reply-To: infodhl_internation@fastservice.com
Subject: DHL SHIPPING ARRIVAL NOTIFICATION
Attachment: DHL TRACKING DETAILS PDF.z (contains "DHL.TRACKING.PDF.exe")

MassLogger SMTP exfil server:
mail.mytravelexplorer.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-10 07:24:08 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=6ohr4l2qwpr67xtu64gpb7spezhl4xo4wdkvzlogc53lcibwvvua._file
Verdict:
malicious
Similar samples:
29bf504889a98344e8f5199b18b4c86314c213de566a7671ddd55856c87c8cfb
MassLogger
2c15880ab47cd785c59229616789de898380c42f6204d926409184c32543cac2
MassLogger
49d77c8caa4d87fa662a587b32f6b138c7eb8b7a4b0ef369af695bb231c2aa4e
MassLogger
5caa7e9eb486ca9161d410e9fe1dc4074c3b0c66f8d6cd05ab5ae6dd35837c5a
MassLogger
6a47bf03b1ffebac3ef5497af7d67aa562f3c401c3694d8551f7092f7f469313
MassLogger
7f2a8610931a1f5ff9793dcb854ca01aaa6410fb5b4dc287753c558f1b60eee1
MassLogger
8447de07af7d5976fca9d1df317d72489dc735fd0fd571d6df0fee9d43cd0448
MassLogger
98f14edea3c84946787d020e97f6b161cae2ed419e458434413626b9893c6f62
MassLogger
cbaf28d8fb7addec023228bbdd6a5062e875070bc16452c15515792b78855000
MassLogger
df2bbdd833be8896f46c8660acfc9da2711f2a75d8338240b781fc6ee3964f9e
MassLogger
+ 6'621 additional samples on MalwareBazaar
Result
Malware family:
masslogger
Create hunting rule
Score:
  10/10
Tags:
family:masslogger ransomware rezer0 spyware stealer
Link:
https://tria.ge/reports/201109-ptxh5lassx/
Behaviour
Creates scheduled task(s)
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Looks up external IP address via web service
Checks computer location settings
Reads user/profile data of web browsers
ServiceHost packer
rezer0
MassLogger
MassLogger log file
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:masslogger_gcch
Create hunting rule
Author:govcert_ch

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

zip 8f6bdc3a0c6418e5aa229a0a6bf308faedd2e2ac2790f1ed7d43c11862871c16

MassLogger

Executable exe f38f1e2f50b3e3efde74f70cf0fe4f264ebe5ddcb0d55cadc61776b12036ad68

(this sample)

  
Dropped by
MD5 5273090c6ee9e6582912b59cda896d24
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 8f6bdc3a0c6418e5aa229a0a6bf308faedd2e2ac2790f1ed7d43c11862871c16

Comments