MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0ce85115b26d769cc29342f77c359fc2177d325e5394154fdc700ea644f69971. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 6


Intelligence 6 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0ce85115b26d769cc29342f77c359fc2177d325e5394154fdc700ea644f69971
SHA3-384 hash: abe9ac7680525da56c66d0d9d6bc2e5eb8af51167d874a90cc39ca46412731407ea43ea77d5f824167ff3d98fa8b0cc8
SHA1 hash: ae820bd10915292a37a5d927147138c4a92e7a8b
MD5 hash: 6de2607d6b582340ac160517edd8feb9
humanhash: muppet-virginia-nine-hot
File name:CCMA Reminder Case NC8221-18.exe
Download: download sample
Signature MassLogger
Create hunting rule
File size:861'184 bytes
First seen:2020-08-05 12:09:00 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'600 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 24576:zPCdrsbFYUufYbpd//TU4tsmkLmQ4v6WBYMp8kWr:eab3H3oUsmkLB4iskr
Threatray 710 similar samples on MalwareBazaar
TLSH 2D05DF5F31D51D8CF9AD8AFF5D3918E38F63F96FC62291973671502A00EA048792AF18
Reporter abuse_ch
Tags:exe MassLogger


Avatar
abuse_ch
Malspam distributing MassLogger:

HELO: slot0.devlinscigars.biz
Sending IP: 104.168.176.75
From: admin@ccma.org.za
Subject: Urgent: CMS - CCMA Reminder: Case NC8221-18 is scheduled for
Attachment: CCMA Reminder Case NC8221-18.gz (contains "CCMA Reminder Case NC8221-18.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
74
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/39548/
Detection(s):
SecuriteInfo.com.CIL.HeapOverride.Heur.6818.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a window
Unauthorized injection to a recently created process
Creating a file
DNS request
Sending an HTTP GET request
Using the Windows Management Instrumentation requests
Reading critical registry keys
Creating a file in the %temp% directory
Moving a file to the %temp% directory
Deleting a recently created file
Setting a global event handler for the keyboard
Result
Threat name:
MassLogger RAT
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/411159
Signature
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for sample
May check the online IP address of the machine
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to steal Mail credentials (via file access)
Yara detected AntiVM_3
Yara detected MassLogger RAT
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0ce85115b26d769cc29342f77c359fc2177d325e5394154fdc700ea644f69971/
Threat name:
ByteCode-MSIL.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-08-05 08:17:15 UTC
AV detection:
22 of 27 (81.48%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=btufcfnsnv3jzqutil3xynm7yilx2ms6kokbkt64oahkmrhwtfyq._file
Verdict:
unknown
Similar samples:
329a2570a79a64645c307b832f6bf62abeb151c14f6f608fd1d3b806a427da9d
MassLogger
35b6e2b8511ae0552a5de87abc510205a9d52a53ca6ed78b44299a31138475c8
MassLogger
4534997b5b146c7caebb2f398e7ea0f2bbf434af23155ad13b0acd09b0487325
MassLogger
801125439e5dd24dcb12ecdcad2f6166351c5b55f7d627b99db92d4fa85435f6
MassLogger
95d334eb3cabab89dede94fa1fdfb66560e7ca453ac25be1729a5c0d2e783934
MassLogger
a23aaa00f7b68ac090aaec5ffbd32d5a9a557333302e72fba232f2f54b38cbbc
MassLogger
a4df7bd8daff5a4723055c7589244e1719c45223f09f42b06a621aad5ee1f2f4
MassLogger
b56dc20e7a6a6b86fb49f3802961cc8b21b75938af4de7bb55db894a8546246c
MassLogger
cf9aa52cd8829760f779772b7b483ff039100b5d6311c85f969553b6ce66d58b
MassLogger
eb98cd837c0994df93bde2019caef785c7b7c9bfc373ca2135d928bd507bf3b3
MassLogger
+ 700 additional samples on MalwareBazaar
Result
Malware family:
masslogger
Create hunting rule
Score:
  10/10
Tags:
ransomware spyware stealer family:masslogger
Link:
https://tria.ge/reports/200805-bwa4qbrvws/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious use of SetThreadContext
Looks up external IP address via web service
Reads user/profile data of web browsers
MassLogger log file
MassLogger
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.45
Link:
https://yomi.yoroi.company/submissions/0ce85115b26d769cc29342f77c359fc2177d325e5394154fdc700ea644f69971

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:masslogger_gcch
Create hunting rule
Author:govcert_ch
Rule name:win_masslogger_w0
Create hunting rule
Author:govcert_ch

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

gz 2cd2395322ceb66f04741314be8723d98810145e80e9a6a619eba94590cb8fc1

MassLogger

Executable exe 0ce85115b26d769cc29342f77c359fc2177d325e5394154fdc700ea644f69971

(this sample)

  
Dropped by
MD5 eb8322178582aae3d19e76a52e333bd0
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 2cd2395322ceb66f04741314be8723d98810145e80e9a6a619eba94590cb8fc1
Cape
Cape
https://www.capesandbox.com/analysis/39548/

Comments