MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f8a4be5923387077b32e65cfea383db1576e5dd068b926a1e9833ff24e48fd64. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 4


Intelligence 4 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f8a4be5923387077b32e65cfea383db1576e5dd068b926a1e9833ff24e48fd64
SHA3-384 hash: d0aef445da2b7bcabb90b8765f0d2da18c791be4f5e4e13ffdd74147a67fa9b0ba02c0c4fae5873418d9f2be0bcb2242
SHA1 hash: 6fdd675db58fe108ec77ad19f72d05d908cbe07c
MD5 hash: 63831c721dddee09571fe4d9df808576
humanhash: oregon-jersey-twelve-east
File name:PO 7405591, 7756947 ,7756740.exe
Download: download sample
Signature MassLogger
Create hunting rule
File size:1'284'608 bytes
First seen:2020-06-19 05:10:47 UTC
Last seen:2020-06-19 05:46:57 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:hWvldz1OFn2r7cKPdFGoZZ0P1KtPRBsETU1TfVq87mQyp62EO:g/1hQ8FGoZZ08tP/XI7VqWmNvE
Threatray 1'053 similar samples on MalwareBazaar
TLSH 6C555C2B74D26809C2680676C1A59B80F2F697863643DB1FF49B039B1F037AFB7164D9
Reporter jarumlus
Tags:MassLogger

Intelligence

File Origin
# of uploads :
2
# of downloads :
71
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/9427/
Detection(s):
SecuriteInfo.com.Artemis.29589.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-19 03:47:47 UTC
AV detection:
25 of 29 (86.21%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=7csl4wjdhbyhpmzomxh6uob5wflw4xoqnc4snipjqm77etsi7vsa._file
Verdict:
suspicious
Similar samples:
16824559bb29a05606e2c4abf8dcebc90af5696cfac9c0d045a13299e1f44698
MassLogger
46fcd198aa60c5510e6afb60b7ca8db803fd876fdbdda5b92481d52d105d1c28
MassLogger
517f3d09030f81666c8a07fc1e8817de66f46c6f821040a96e5d54427fd69756
MassLogger
9837ba70f7d9df220a25f6f3ac7cb395d09928226deec41d9d68983e6a377c27
MassLogger
ad1f04e65e53e8aeec125a0e2dbfbbfec362508214315df973d331057aaf77c6
MassLogger
afb36acc2f0bbabca29232e70f3d7aadc4106083e90b60dc432fbe1db98ddbf7
MassLogger
b18c9e75825836541b9d7015a4a53dacddae7bb29c3bedbca9758349d9de7425
MassLogger
be5e5be8981ef261f24b21b1d6b67f5041d10ecc3eb3697a67142d43e71c7ece
MassLogger
ead217093eb194a4c15621c50213435e6e7bb2d955a4cd38a3f20acd099fba7b
MassLogger
f0006593faf51305737fab3e4aa62f4ead00200011ca09375ae438e04953859e
MassLogger
+ 1'043 additional samples on MalwareBazaar
Result
Malware family:
masslogger
Create hunting rule
Score:
  10/10
Tags:
ransomware stealer spyware family:masslogger
Link:
https://tria.ge/reports/200624-kxx3e4sl5x/
Behaviour
Suspicious behavior: EnumeratesProcesses
Creates scheduled task(s)
Delays execution with timeout.exe
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Looks up external IP address via web service
Loads dropped DLL
Executes dropped EXE
MassLogger log file
MassLogger
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:masslogger_gcch
Create hunting rule
Author:govcert_ch

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

gz ff49433d67b8d8ffb6c3757b20b3baf4f45399ec3560876ef4f819b0aae6c194

MassLogger

Executable exe f8a4be5923387077b32e65cfea383db1576e5dd068b926a1e9833ff24e48fd64

(this sample)

  
Dropped by
MD5 5ce17b50e448c0949b5d9fd4f511ee34
  
Dropped by
SHA256 ff49433d67b8d8ffb6c3757b20b3baf4f45399ec3560876ef4f819b0aae6c194
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/9427/

Comments