MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f98d355a4771e886220488b0bffa005af9769480cde5aad275d4166c2f9b2e48. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

MassLogger

Vendor detections: 5

Intelligence 5 IOCs YARA 1 File information Comments

SHA256 hash:	f98d355a4771e886220488b0bffa005af9769480cde5aad275d4166c2f9b2e48
SHA3-384 hash:	64b20043cc38d9a4b8c1979a653719df4cad7ddd4b96e4d4acc84ad8b1b319b93eb60d55891af9d3dac0d5309d9e9875
SHA1 hash:	e0b419b7f13e1271f32b46551febed8d5168f328
MD5 hash:	6518afc08223493b4e6303248a6c70d0
humanhash:	fifteen-alabama-snake-arkansas
File name:	scan00465.pdf.exe
Download:	download sample
Signature	MassLogger Create hunting rule
File size:	1'158'144 bytes
First seen:	2020-06-09 06:03:23 UTC
Last seen:	2020-06-09 13:04:06 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep	24576:PXQFZc0MrDwAAlWqjCJGJA0US7RIojMEEY6pAIEkykDHTv68+F1q:oFZcwRj9AoR349pAov/+W
Threatray	477 similar samples on MalwareBazaar
TLSH	8935D081F64496A0CC6D97B09676CD3482637DEA7D30D41D28CE3E677BFBB922411C8A
Reporter	abuse_ch
Tags:	exe MassLogger

abuse_ch

Malspam distributing MassLogger:

HELO: dayacom.com.tw
Sending IP: 156.96.62.53
From: (Ms) ivy leung <sales@dayacom.com.tw>
Reply-To: (Ms) ivy leung <saIes@dayacom.com.tw>
Subject: revised product enquiry, sample request
Attachment: scan00465.pdf.zip (contains "scan00465.pdf.exe")

MassLogger SMTP exfil server:
mail.saritatravels.com:587

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.LuheFihaA.14154.28340.UNOFFICIAL

Gathering data

Threat name:

Win32.Trojan.Kryptik

Status:

Malicious

First seen:

2020-06-09 00:19:40 UTC

AV detection:

22 of 29 (75.86%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=7ggtkwshohuimiqercyl76qall4xnfeazxs2vutv2qlgyl43fzea._file

Verdict:

malicious

MassLogger

6299f3e36dc84d0d1aa0b460cfe353d8460f8aae5b13aa75aab9d8ea2efc1a7a

MassLogger

64a0f19845c2724ec1e75467da1f1cab42ef3a78914171af40a0c4c8f798a9fd

MassLogger

740937dc2e4ce55ffde8c557976b25715c76db9ee3d7dd0e8f866983575c8621

MassLogger

8c3156c901bae62d20fce1aa07a4c0e0252ac6ab6443877396a37f83441f2b65

MassLogger

9336f77019f21d2e8e512509c4c246925c6b3cf96d03ac45f080bbc330055d7b

MassLogger

d2827b9a0edb006fbb6ade9f63d0948515ace0f6199a5a59725b8279eed54f25

MassLogger

e337cef021313425e1bb071d32482f61722d1980e8bb0d2deac6c2cd1f7bce55

MassLogger

e772c14876f251ad71aa44567a90859fef8979860f44c77981d537fca37e7400

MassLogger

f1542701299aa44f2329dde6c86e571ebd11566aec5700ae5dd48c283d7ef6ac

MassLogger

+ 467 additional samples on MalwareBazaar

Result

Malware family:

masslogger

Score:

10/10

Tags:

family:masslogger ransomware rezer0 spyware stealer

Link:

https://tria.ge/reports/201109-cnsgc93pvn/

Behaviour

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Looks up external IP address via web service

Checks computer location settings

Reads user/profile data of web browsers

ServiceHost packer

rezer0

MassLogger

MassLogger log file

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.