MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0d6f912181bf01b2197d8501f5b38f6c009c6c4a4e76fa6e0b3d2d4efe05bfbb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 8


Intelligence 8 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0d6f912181bf01b2197d8501f5b38f6c009c6c4a4e76fa6e0b3d2d4efe05bfbb
SHA3-384 hash: 7c37c54d13eea2540b6fc0326ffb5b984d83953533cf9acecb65bea3d927dd9d13b1c1460046747f6a926b3e18d17f9c
SHA1 hash: 2388ea10dc5b6cb0ca775ccbbfbfd34a5607c9cc
MD5 hash: 6fc73d42ccb00ce01c8ce8775d3311ce
humanhash: hotel-finch-black-oxygen
File name:FACTURA PENDIENTE.exe
Download: download sample
Signature MassLogger
Create hunting rule
File size:1'764'864 bytes
First seen:2020-11-09 16:02:49 UTC
Last seen:2020-11-09 17:50:03 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:HFYd/hfgQnKPvI31T2rOqobw/HpdmiuxOnPeT9nGya4SqCCKApDORkoPuUXQScso:uFlgQw78tLh5hjLhtyA2Y4faZ
Threatray 535 similar samples on MalwareBazaar
TLSH 9985E85854A9638BD43737AD9B383581C3B4DA2332E9C9D3419CBAF2EE8DC358B71905
Reporter abuse_ch
Tags:exe MassLogger


Avatar
abuse_ch
Malspam distributing MassLogger:

HELO: vps9311.ervers.com
Sending IP: 46.231.1.154
From: Elvira Medina <contabiIidadtiendas@cabanyero.com>
Subject: FACTURA PENDIENTE
Attachment: FACTURA PENDIENTE.exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
113
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Artemis6FC73D42CCB0.15904.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Using the Windows Management Instrumentation requests
Unauthorized injection to a recently created process
Creating a file
DNS request
Sending an HTTP GET request
Launching a process
Reading critical registry keys
Setting a global event handler for the keyboard
Result
Threat name:
MassLogger RAT
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/526620
Signature
Adds a directory exclusion to Windows Defender
Injects a PE file into a foreign processes
Machine Learning detection for sample
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file access)
Yara detected Costura Assembly Loader
Yara detected MassLogger RAT
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0d6f912181bf01b2197d8501f5b38f6c009c6c4a4e76fa6e0b3d2d4efe05bfbb/
Threat name:
ByteCode-MSIL.Trojan.Azorult
Create hunting rule
Status:
Malicious
First seen:
2020-11-09 11:33:50 UTC
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=bvxzcimbx4a3egl5qua7lm4pnqajy3ckjz3pu3qlhuwu57qfx65q._file
Verdict:
malicious
Label(s):
masslogger
Create hunting rule
Similar samples:
2fea8f7c727460dfd943dce7f9bb051f188f37a0150a132039a1892f18749ff3
MassLogger
35b9ef9216cb6d917ce85fc3954647362b1053bab646e728981a2c234afe5018
MassLogger
40773de06176ad60a969f29e1034064ea20c67192922285319045afc91b6c3e0
MassLogger
70caf501b061da2729d33d4b0c5e9b9c58bc554cdbdddef16f7e057ea346808c
MassLogger
a2b0e9c1ea03a3a538fe9ef7f8e6dbf4c08feba8560e238e29fce0dd2f2e144b
MassLogger
b3c6ea8a1d611c88699d927c3f6c84d213b596d8d4220618b3ed4dc1bc5f5fe4
MassLogger
ba4e39e16f3599f9bfe3b5dd1664e0d071d2dfeb308e9380778c8360495f61d5
MassLogger
ca74ca06ac3bfd92aabfc85fc7e10ae5d9e2e6306ed488eb7bf0b06640890a9f
MassLogger
da5de33aa29159ce3331c060ed0da0b17346037aa12960652d67ecc7ba6d44a5
MassLogger
f784d412a56ccd414525c22e6b2e7c9482040e89be20fdb1f2e4db0016812ea7
MassLogger
+ 525 additional samples on MalwareBazaar
Result
Malware family:
masslogger
Create hunting rule
Score:
  10/10
Tags:
family:masslogger spyware stealer
Link:
https://tria.ge/reports/201109-6fz29131hx/
Behaviour
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Looks up external IP address via web service
Checks computer location settings
Reads user/profile data of web browsers
MassLogger
MassLogger Main Payload
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0d6f912181bf01b2197d8501f5b38f6c009c6c4a4e76fa6e0b3d2d4efe05bfbb

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Keylog_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Contains Keylog
Rule name:masslogger_gcch
Create hunting rule
Author:govcert_ch
Rule name:win_masslogger_w0
Create hunting rule
Author:govcert_ch

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

Executable exe 0d6f912181bf01b2197d8501f5b38f6c009c6c4a4e76fa6e0b3d2d4efe05bfbb

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments