MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 10e38bdb1a32d7a54e877e6404fa4882b0049e2ee87b1558470b19eded1f4376. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 7


Intelligence 7 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 10e38bdb1a32d7a54e877e6404fa4882b0049e2ee87b1558470b19eded1f4376
SHA3-384 hash: 5161bda6b70bbf0a939419900911578e5f1e30c05918853ecbedda5b2ef196d3fe7d1a44a33babc4e58e8a03372661a0
SHA1 hash: 549f5844e7322a903fa0c95caa916ff088e833dd
MD5 hash: 2ae4cff4e27d84e9b12cf24eacd5ee08
humanhash: wolfram-uniform-ten-magazine
File name:Vj8GSshf5LYMlZJ.exe
Download: download sample
Signature MassLogger
Create hunting rule
File size:1'433'088 bytes
First seen:2020-08-06 13:27:59 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'474 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 24576:1v1Hq/nU4BZGL50mD0H2i+p1PPIJdDBt3M:t1Hq/U4SwE4lt
Threatray 585 similar samples on MalwareBazaar
TLSH 3265F12967D4050AE45B0B7DBD72814FBA75EC461E17930B2377B0AE4D7B3889E80B86
Reporter James_inthe_box
Tags:exe MassLogger

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/41205/
Detection(s):
SecuriteInfo.com.Trojan.Inject3.46680.31093.31669.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Result
Threat name:
MassLogger RAT
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/414000
Signature
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
May check the online IP address of the machine
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sigma detected: Scheduled temp file as task from temp location
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to steal Mail credentials (via file access)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AntiVM_3
Yara detected Costura Assembly Loader
Yara detected MassLogger RAT
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/10e38bdb1a32d7a54e877e6404fa4882b0049e2ee87b1558470b19eded1f4376/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-08-06 09:27:01 UTC
File Type:
PE (.Net Exe)
Extracted files:
21
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=cdryxwy2gll2ktuhpzsaj6siqkyajhro5b5rkwchbmm633i7in3a._file
Verdict:
unknown
Similar samples:
15ac6b1a7fdb92b545dae44b1a88d6328629944771bdce75002637cdbf299027
MassLogger
271ae8f2104165d934488b9888b1fdcf6d6ec9a2263a603270ac9098f5d27323
MassLogger
329a2570a79a64645c307b832f6bf62abeb151c14f6f608fd1d3b806a427da9d
MassLogger
35b6e2b8511ae0552a5de87abc510205a9d52a53ca6ed78b44299a31138475c8
MassLogger
49406d04e4b7268279ea17e07bdb6e89c1d09b599b5afc2f9e95983db09125ef
MassLogger
a551bc2327862c1430dac51dce368001622525fae235ca689f7b055e0d3125c7
MassLogger
a990373e6225384bd1bab3441dc0cb881f1e03f51f83f7923ca6c9ff228bee5c
MassLogger
b56dc20e7a6a6b86fb49f3802961cc8b21b75938af4de7bb55db894a8546246c
MassLogger
dc05645067f3f3ccf6a4e647dcf935c928fd981ef904672603a7ab409488166e
MassLogger
eb98cd837c0994df93bde2019caef785c7b7c9bfc373ca2135d928bd507bf3b3
MassLogger
+ 575 additional samples on MalwareBazaar
Result
Malware family:
masslogger
Create hunting rule
Score:
  10/10
Tags:
ransomware stealer spyware family:masslogger
Link:
https://tria.ge/reports/200806-s7axp51q6x/
Behaviour
Suspicious use of WriteProcessMemory
Creates scheduled task(s)
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Creates scheduled task(s)
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Looks up external IP address via web service
Reads user/profile data of web browsers
MassLogger log file
MassLogger
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/10e38bdb1a32d7a54e877e6404fa4882b0049e2ee87b1558470b19eded1f4376

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:masslogger_gcch
Create hunting rule
Author:govcert_ch
Rule name:win_masslogger_w0
Create hunting rule
Author:govcert_ch

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/41205/
  
URLhaus
https://urlhaus.abuse.ch/url/426052/

Comments