MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 10939877f109569dff853eef9ddb462dda69871bc04b44d45d1a784a21a208ba. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
MassLogger
Vendor detections: 6
| SHA256 hash: | 10939877f109569dff853eef9ddb462dda69871bc04b44d45d1a784a21a208ba |
|---|---|
| SHA3-384 hash: | 66d465a509913dc2bddc9f17fa9ed7ead61dbd51d2f207ef4cfbb0e772853124361927c4828e002cacbb49c7b608611a |
| SHA1 hash: | 6d7e6c8743f130c0a23551061516b47a9510729b |
| MD5 hash: | 63ae3d497fc808ba1f4c5109d76c457f |
| humanhash: | hotel-massachusetts-don-fillet |
| File name: | Attached AWB.exe |
| Download: | download sample |
| Signature | MassLogger |
| File size: | 965'632 bytes |
| First seen: | 2020-07-10 18:01:35 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'672 x AgentTesla, 19'494 x Formbook, 12'214 x SnakeKeylogger) |
| ssdeep | 24576:os+KhRcyG0EWYxNw1Aj/T0aZ/csr7P5Q5M:TuxOI0K/BVq |
| Threatray | 2'085 similar samples on MalwareBazaar |
| TLSH | 4F2502707EF1AAC1C63E4E725872CC104A35EA2B6712E79B1DC52DAF186FBC50542B87 |
| Reporter |  abuse_ch |
| Tags: | exe MassLogger |
abuse_ch
Malspam distributing MassLogger:HELO: ambit.co
Sending IP: 185.144.28.112
From: Vikram Waroshe<vikram.manwani@ambit.co>
Subject: Attached AWB.
Attachment: Attached AWB.zip (contains "Attached AWB.exe")
MassLogger SMTP exfil server:
smtp.yandex.ru:587
Intelligence
File Origin
# of uploads :
1
# of downloads :
91
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Detection(s):
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Using the Windows Management Instrumentation requests
Reading Telegram data
Creating a file
Reading critical registry keys
Moving a recently created file
Deleting a recently created file
Threat name:
ByteCode-MSIL.Trojan.CryptInject
Status:
Malicious
First seen:
2020-07-10 18:03:06 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Similar samples:
+ 2'075 additional samples on MalwareBazaar
Result
Malware family:
masslogger
Score:
10/10
Tags:
spyware stealer family:masslogger
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Looks up external IP address via web service
Reads user/profile data of web browsers
MassLogger
MassLogger log file
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.