MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f839a819163970a1d45b5abc0eef10990dc371701cbec42b80f3c7affd7126f4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 3


Intelligence 3 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f839a819163970a1d45b5abc0eef10990dc371701cbec42b80f3c7affd7126f4
SHA3-384 hash: cb035815ff20965e0807f91f08b22390cc2d16b37d4f4967ba797adc7e662b6dde2b94f77d14bd1e182d6ad6d05c3d09
SHA1 hash: eb43049646d3c90feb139214803436cac979fbb7
MD5 hash: ef1562d569c71980fccd769bbf53fd0a
humanhash: missouri-alabama-mango-finch
File name:INQUIRY.exe
Download: download sample
Signature MassLogger
Create hunting rule
File size:819'712 bytes
First seen:2020-05-26 17:15:45 UTC
Last seen:2020-05-26 18:08:27 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 24576:hKgAnV0G3yv456runLg/S+8Tomal01nOv:IfV02yv4gKnLoYaCnO
Threatray 451 similar samples on MalwareBazaar
TLSH 1605CFBC355436DFC57BC2358AE80C25BAE0606763175F2F4467129D9A8E7C3CEA01AE
Reporter James_inthe_box
Tags:exe MassLogger

Intelligence

File Origin
# of uploads :
3
# of downloads :
75
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.33907287.12016.4538.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-26 04:32:25 UTC
File Type:
PE (.Net Exe)
Extracted files:
1
AV detection:
20 of 31 (64.52%)
Threat level:
  2/5
Verdict:
malicious
Similar samples:
112d707367a7101031fb617c9514187ca68b817a27b6b6a2ecc1b737dc974a1a
MassLogger
239fca3f5df496aab1b7c7696aaa26d77174501abc9cb1c1e12a188584d745cc
MassLogger
25713dac1c6cb3444ccdb4439510b4e396fd217fcd6a5d1c3d40b48ae2716616
MassLogger
2807548dd82445eeac614506066b893c6cd90c8b02c6374dfa491defc817007a
MassLogger
3ab173f1c673d450f1f9640193efc87c76e64687e4c43ea0024287c875cde792
MassLogger
40eac0b9c7fb03c9f4a54a82b47534babfdcc931b5d83832f1ae2facd9fe0cc3
MassLogger
4d47d2e29b7056f1d96947436ffc1eb030102f1b4b949d7708d33e77a321a831
MassLogger
5136cc442f7ff2a99cb5c3c64c0419d23a3aba57f7389af3a758615eb8b6d26b
MassLogger
5b2facc5a7a9b51aad80b259535b451e25598fd154dac6d6df0820a784b6005f
MassLogger
e64a8bcf44c1671d77ee091bf44aa2021c71fb8349562dcbb4c7d6d1686d1611
MassLogger
+ 441 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-a1lf1d7nzs/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:masslogger_gcch
Create hunting rule
Author:govcert_ch

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments