MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1216760b7cd8f2c6be3e6ddabaea8e1068faf26f97a5f9a1575a139904cd58d3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

MassLogger

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	1216760b7cd8f2c6be3e6ddabaea8e1068faf26f97a5f9a1575a139904cd58d3
SHA3-384 hash:	81ba2de86ea308de4526b3799d3fa63736480c8172fc87f124eb743dd3ea58ebd5e5ccd74418bfd8001385eccf6478b6
SHA1 hash:	54d240a372703587500ede18c1dc1bcf0c5972a6
MD5 hash:	c30cd0191fdbddd45e213a7b89256749
humanhash:	utah-wolfram-ink-sierra
File name:	GHB08072020.exe
Download:	download sample
Signature	MassLogger Create hunting rule
File size:	1'255'424 bytes
First seen:	2020-07-08 06:32:48 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'461 x Formbook, 12'202 x SnakeKeylogger)
ssdeep	24576:oAlZjiCZKIMip8OS0xn86cLpzuvy+RoMjUp/nFCZPVN/+Wo0GjO9JslhtW4slht8:oOZjiCZKIMip8OS0xn86cLpzuvtuMgCS
Threatray	1'178 similar samples on MalwareBazaar
TLSH	EF45DF27BEA5B602C66E0F37D962010C6E765C5F7EC6E68B1DCC31ADCA7A7441903B06
Reporter	abuse_ch
Tags:	exe MassLogger

abuse_ch

Malspam distributing MassLogger:

HELO: dongsonvina.co
Sending IP: 111.90.145.70
From: Sham J. Vaikos <Sham.Vaikoss@varroc.com>
Reply-To: jose.fili.gameiros@gmail.com
Subject: Require quotation
Attachment: GHB08072020.rar (contains "GHB08072020.exe")

MassLogger SMTP exfil server:
smtp.yandex.ru:587

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/22845/

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Creating a file in the %AppData% directory

Creating a file in the %temp% directory

Launching a process

Creating a process with a hidden window

Deleting a recently created file

Unauthorized injection to a recently created process

Enabling autorun with Startup directory

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/1216760b7cd8f2c6be3e6ddabaea8e1068faf26f97a5f9a1575a139904cd58d3/

Threat name:

ByteCode-MSIL.Trojan.Masslogger

Status:

Malicious

First seen:

2020-07-08 06:34:12 UTC

AV detection:

23 of 29 (79.31%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=cilhmc343dzmnpr6nxnlv2uocbupv4tps6s7tikxlijzsbgnldjq._file

Verdict:

malicious

MassLogger

175dc1ef3ca07f65986afd11a9ee79ba66d92e8bb2ab11ae0fc2a8a06f630f78

MassLogger

3f97dfbae448b3eb28d6f08f666029037d890dc94dbce0e372b4dd2a63fd037f

MassLogger

4193084a6eba68bbb6aef41ffc1f21685208c6b942de9e5853b70b04834c296e

MassLogger

420541ff7ab7f97d2110f9c2f2488087c0d2f9e577fa5e55c73eebf4f5416bbc

MassLogger

a05377124fe9f9a262ddb1b58d2eac7556299ec686bf5c2f005bd4792131a3c8

MassLogger

b929c43ad6f3aefd59485197209608aee28ba2517eba13c2cdf2fe8c6a3d1d5d

MassLogger

e3b22f7b9f72b19b41dfe024803aeeaa88d0072a3e10a5bea82413285721c91b

MassLogger

e4b1c7f2f04d674f545b52a14617dfc553b65991c4779d1b22bf41982d1201ff

MassLogger

fbb99e9576db212b02fd60fc214d3cd9faa9f2f019103ea8dc1aec8424bd4ba7

MassLogger

+ 1'168 additional samples on MalwareBazaar

Result

Malware family:

masslogger

Score:

10/10

Tags:

spyware stealer family:masslogger

Link:

https://tria.ge/reports/200708-b1sf2b7sxx/

Behaviour

Creates scheduled task(s)

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: AddClipboardFormatListener

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of SetThreadContext

Looks up external IP address via web service

Reads user/profile data of web browsers

MassLogger log file

MassLogger

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.