MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1342cdcc9231fdd7637c5a78b07485e5f2fb706479e0441f0b53bd1bd8228697. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

MassLogger

Vendor detections: 4

Intelligence 4 IOCs YARA 1 File information Comments

SHA256 hash:	1342cdcc9231fdd7637c5a78b07485e5f2fb706479e0441f0b53bd1bd8228697
SHA3-384 hash:	b62e8cd2f5d2c0b30d224d74326148ec44ad6581d6eb6e919f9ad9d27ad65eee58bf329e5c46a581d29c454abe7de1f9
SHA1 hash:	9c345ae6ed109d9da39f7f93f7bb81174e6f9fd2
MD5 hash:	97615be6918cdb51eee1e7f1b14bbb36
humanhash:	tango-network-three-beryllium
File name:	PZS-172.exe
Download:	download sample
Signature	MassLogger Create hunting rule
File size:	731'648 bytes
First seen:	2020-06-30 09:05:59 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'647 x AgentTesla, 19'450 x Formbook, 12'201 x SnakeKeylogger)
ssdeep	12288:W8ISd50BJnq7rQAGIZn5lcF1gazEoX92WXK0lsnmZxLpekSW3R7tXjDS+udh:WUdWBxqAtKn5qzhMW60lemZdpekSmbTo
Threatray	721 similar samples on MalwareBazaar
TLSH	AAF4122875AE293BCABC05F94893550207B4E4977C03FBD68DE9B1DD02CAF991252E73
Reporter	abuse_ch
Tags:	exe HostGator MassLogger

abuse_ch

Malspam distributing MassLogger:

HELO: gateway20.websitewelcome.com
Sending IP: 192.185.58.11
From: Masoumeh <m.aligol@climaxoilfield.ae>
Subject: RFQ-PZS-172
Attachment: PZS-172.rar (contains "PZS-172.exe")

MassLogger SMTP exfil server:
us2.smtp.mailhostbox.com:587

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/17072/

Detection(s):

SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/1342cdcc9231fdd7637c5a78b07485e5f2fb706479e0441f0b53bd1bd8228697/

Threat name:

ByteCode-MSIL.Trojan.Kryptik

Status:

Malicious

First seen:

2020-06-30 04:40:20 UTC

AV detection:

23 of 28 (82.14%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=cnbm3tesgh65oy34lj4la5ef4xzpw4dephqeihylko6rxwbcq2lq._file

Verdict:

unknown

MassLogger

3277c38c152ed39a94dbc50b60675ba3438631243837bf30ce65c996ceab524d

MassLogger

37eb096457c5f3b81945f57de1b46674cdd7ccf83714f0bc4c0d982ade2405bd

MassLogger

41df7c7f04b04ac0f2eb88f099c9df36f01e11eaff1c189573f49054758d653d

MassLogger

43756195653d9b20db70b3b2700d6ece0e927da322db216d12e6eeb6af316f3f

MassLogger

50b298120d93f328fa5949eeb470a41ac0e846b28df37d46cb16c0beaa1b128e

MassLogger

5706101b5ffaf565a5690227f1c273b174eb2dcd3565904984a36be84eca6645

MassLogger

76933bfe9afdf8d266352155f09995acadcab23345fabe2518d5bf15d45c9cd4

MassLogger

adfd200a16ffe7c04631176e3ad03ded8785c7ecf9581f42915ea199f8c27e9b

MassLogger

ff0b197ef34800ad007a5caedaf485af5ae523343ce8ec106d3a253d2c0a4a35

MassLogger

+ 711 additional samples on MalwareBazaar

Result

Malware family:

masslogger

Score:

10/10

Tags:

ransomware spyware stealer family:masslogger

Link:

https://tria.ge/reports/200630-9xt37nyqej/

Behaviour

Suspicious behavior: AddClipboardFormatListener

Creates scheduled task(s)

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

Suspicious use of SetThreadContext

Looks up external IP address via web service

Reads user/profile data of web browsers

MassLogger

MassLogger log file

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.