MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 11c1f4cb84f8d31e6cece374a11f090d3cbfd9cb9a94057d351bcac45480ad1c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 11c1f4cb84f8d31e6cece374a11f090d3cbfd9cb9a94057d351bcac45480ad1c
SHA3-384 hash: 035c75e385625e73c0e56810cab2908b0fd9e1fa63c9fb0b785fbf9959e6aa9ede7abc90db07a02cd6d07506cab81b04
SHA1 hash: 94758288474cb39651ca55a0771b0e9014d0cd35
MD5 hash: f1c2d9aca2d74fa58635a6b4bd87a4fc
humanhash: hot-pasta-uniform-finch
File name:Samples and Specification.exe
Download: download sample
Signature MassLogger
Create hunting rule
File size:1'104'896 bytes
First seen:2020-07-20 09:26:36 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 24576:KujYOUjfvEU4YymJ5KboB8MBNtd4cR+y5coW2rEloD:pYOUDvE0tHDAymKrso
Threatray 784 similar samples on MalwareBazaar
TLSH 353501C8AAA05500C6ED3FF59F628AB54335BD05F5F2930F2BC0AC9B297A793D854352
Reporter abuse_ch
Tags:exe MailChannels MassLogger


Avatar
abuse_ch
Malspam distributing MassLogger:

HELO: beige.elm.relay.mailchannels.net
Sending IP: 23.83.212.16
From: sino <sino_frank@capstoneeeq.com>
Subject: URGENT PURCHASE ORDER
Attachment: Samples and Specification.zip (contains "Samples and Specification.exe")

MassLogger FTP exfil server:
ftp.ads-logitics.com:21

Intelligence

File Origin
# of uploads :
1
# of downloads :
80
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/28874/
Result
Threat name:
MassLogger RAT
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/391226
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/11c1f4cb84f8d31e6cece374a11f090d3cbfd9cb9a94057d351bcac45480ad1c/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-07-20 09:27:08 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=cha7js4e7djr43hm4n2kchyjbu6l7woltkkak7jvdpfmiveavuoa._file
Verdict:
unknown
Similar samples:
11a0a7f8a1ad05d1989ae7ce089843379c1b6ab748e3e14d81061004cdcf1b1b
MassLogger
361b870ce5f03b00cd0bd8b38c126a247cedddac310047ecd9fcbab921022de9
MassLogger
42482d36162c303c7dd784ea301aa70e666cfb2659ccbbef0424f4e1081c449f
MassLogger
45d8ff8d9a0af67be186239fd69da54cfb86031efbc4bc8ea033834c3e9b6d1d
MassLogger
55d2fe466aeeb92b6f8b45ac8a3961da32e03211f9d006347d946d072cba3848
MassLogger
662e6858fb2067c38af99173b7a3201a148bd9104771badd96868bccc20ec687
MassLogger
ace900e217f27e8f699718623c3c2dcc7bf91337ff0ff91fc5a365a68fd7ba65
MassLogger
cede878f4e547d56af974c5aa1afd6dfddbb857ca9d60422c9565a1961e22485
MassLogger
e699b803c7f94c7d211707e0869f7a07dddda3f383750c2b8ce5d4d16daf7178
MassLogger
ebd23b0402ce1f9f8d45a37ec77fc89381869a3399aa2d405830e7eb05299ad3
MassLogger
+ 774 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/200720-prdt7lwwpx/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Creates scheduled task(s)
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Program crash
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/11c1f4cb84f8d31e6cece374a11f090d3cbfd9cb9a94057d351bcac45480ad1c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:masslogger_gcch
Create hunting rule
Author:govcert_ch

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

zip 986086d0ceabd397222e9db2b5e39d5bf71a44b2182769bf5fa8170f03c71bf9

MassLogger

Executable exe 11c1f4cb84f8d31e6cece374a11f090d3cbfd9cb9a94057d351bcac45480ad1c

(this sample)

  
Dropped by
MD5 259bb61e67c5458655a47ca2c1cae68b
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/28874/
  
Dropped by
SHA256 986086d0ceabd397222e9db2b5e39d5bf71a44b2182769bf5fa8170f03c71bf9

Comments