MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 112d707367a7101031fb617c9514187ca68b817a27b6b6a2ecc1b737dc974a1a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

MassLogger

Vendor detections: 4

Intelligence 4 IOCs YARA 1 File information Comments

SHA256 hash:	112d707367a7101031fb617c9514187ca68b817a27b6b6a2ecc1b737dc974a1a
SHA3-384 hash:	e701cdd4542d289a16ac5c012cd6c53430f6e116cfb7e038573da97077a3d8f4bcc87b544bc14cdc3633720a78fc80f7
SHA1 hash:	0a542637796e19ea1cb3379471ba69fcdd9b239e
MD5 hash:	f7ce9ae72c2106ca0b0b85188b43f758
humanhash:	zulu-delta-georgia-queen
File name:	Order List.exe
Download:	download sample
Signature	MassLogger Create hunting rule
File size:	960'000 bytes
First seen:	2020-05-27 07:48:05 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'603 x Formbook, 12'241 x SnakeKeylogger)
ssdeep	12288:yDBE/5pdhS8knapfK5c9CErLSaLmWehpEsBfWZq0DMu0zmSYxYcNzPcSi5bHrj9Q:6i5q0iV4qJflOt0zmSYxYcNz
Threatray	458 similar samples on MalwareBazaar
TLSH	EB15E08C765076DFC917C976DEA41D65AB61B46B431BD307A01322AC9E0EAABCF110F3
Reporter	abuse_ch
Tags:	exe MassLogger

abuse_ch

Malspam distributing MassLogger:

HELO: mail.909.com.tw
Sending IP: 218.32.210.122
From: Morris <morris@win-textile.com>
Subject: Re: New Order List
Attachment: Order List.zip (contains "Order List.exe")

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.MSIL.Kryptik.WBA.25524.UNOFFICIAL

Gathering data

Threat name:

ByteCode-MSIL.Trojan.Kryptik

Status:

Malicious

First seen:

2020-05-27 09:03:15 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

25 of 31 (80.65%)

Threat level:

2/5

Verdict:

malicious

MassLogger

4d47d2e29b7056f1d96947436ffc1eb030102f1b4b949d7708d33e77a321a831

MassLogger

5b2facc5a7a9b51aad80b259535b451e25598fd154dac6d6df0820a784b6005f

MassLogger

67a5b58d36ef0884ee86d601a72ffb085c02aa9cfa40cd3a869ea6806084a011

MassLogger

8b701ead5af587161656419272dfa0fca1087ce8f5603ad1e6f70332f9a1fb04

MassLogger

a2c284a50d4fc05794e3bce123492bd9e547b272d9f7b87832fdc72b681580e7

MassLogger

a97835df055504850909bdb785d2bd535cc22702f418147cc3af6d4add370a59

MassLogger

aadeefdff2d2e15548eebcc0d510784f7ba79aaeee9615b3705f30b60b352e5b

MassLogger

e64a8bcf44c1671d77ee091bf44aa2021c71fb8349562dcbb4c7d6d1686d1611

MassLogger

f839a819163970a1d45b5abc0eef10990dc371701cbec42b80f3c7affd7126f4

MassLogger

+ 448 additional samples on MalwareBazaar

Result

Malware family:

masslogger

Score:

10/10

Tags:

family:masslogger coreentity evasion ransomware rezer0 spyware stealer

Link:

https://tria.ge/reports/201109-4ww9gkygxe/

Behaviour

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Looks up external IP address via web service

Maps connected drives based on registry

Checks BIOS information in registry

Checks computer location settings

Looks for VMWare Tools registry key

Looks for VirtualBox Guest Additions in registry

rezer0

CoreEntity .NET Packer

MassLogger

MassLogger log file

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.