MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 199653ca7cce2aabf2b54f899d29ab68526525a14487f0f1e02b45a0ad3e1f7c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 199653ca7cce2aabf2b54f899d29ab68526525a14487f0f1e02b45a0ad3e1f7c
SHA3-384 hash: c50031c68f50dfb078bd2a88e50398c0adfe647663e1451673404726c78e708af437d6fe033659bd7f8967316cdd08c7
SHA1 hash: bcea10b21b7ae9b07aaa776292703df96161b78d
MD5 hash: 5cba80940c9c4c465a4f437149f0dafe
humanhash: charlie-winner-kilo-thirteen
File name:65mwynYNnvreZUG.exe
Download: download sample
Signature MassLogger
Create hunting rule
File size:894'464 bytes
First seen:2020-10-10 06:41:05 UTC
Last seen:2020-10-10 08:04:59 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'606 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 24576:SpAG16dfhglDil2qSiliVotnaKHghbdMwa+:SR16QlDifSkKiMbdn
Threatray 305 similar samples on MalwareBazaar
TLSH 26152300474936B1D96E0FF8A65C5B152BB165336A02EF4E4CDDB9EB0AB3B619E40B07
Reporter abuse_ch
Tags:DHL exe MassLogger


Avatar
abuse_ch
Malspam distributing MassLogger:

HELO: server.nazarweb.org
Sending IP: 93.187.207.112
From: DHL International <abaran@diyarbakiroto.com.tr>
Reply-To: <donatella@fabiorusconi.it>
Subject: Re: Your Shipment invoice & packing-list
Attachment: Invoice and packing list PDF.rar (contains "65mwynYNnvreZUG.exe")

Intelligence

File Origin
# of uploads :
2
# of downloads :
120
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/69692/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Creating a file in the %AppData% directory
Creating a file in the %temp% directory
Launching a process
Creating a process with a hidden window
Deleting a recently created file
Unauthorized injection to a recently created process
Creating a file
Using the Windows Management Instrumentation requests
Enabling autorun by creating a file
Deleting of the original file
Result
Threat name:
MassLogger RAT
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/487395
Signature
.NET source code contains potential unpacker
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Deletes itself after installation
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sigma detected: Scheduled temp file as task from temp location
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AntiVM_3
Yara detected Costura Assembly Loader
Yara detected MassLogger RAT
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/199653ca7cce2aabf2b54f899d29ab68526525a14487f0f1e02b45a0ad3e1f7c/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-09 08:56:48 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=dglfhst4zyvkx4vvj6ez2knlnbjgkjnbisd7b4pafnc2blj6d56a._file
Verdict:
malicious
Label(s):
masslogger
Create hunting rule
Similar samples:
6216fb2168b1474fab471b069bf9df20243fa22050db71ec20bd6d5f5cf46a3e
MassLogger
6988a60d042c049bb04da81e5921e7848aa562faccb7ee555a9e324275e5b2dc
MassLogger
6fb6937cf1cdf0d1c89ba807e43754a2d06754cd820992dc0b91cb61540cf547
MassLogger
703698c23e6a2e0a7fa23c5868bb97bccdca0389b47b0ea33a013a959a4a83e6
MassLogger
8867e72aaf3985ed148d3049c628d73ba0024e3129e466c17bd6a665be9e84f0
MassLogger
8f1df804a5fc826de1487d95db7e15faede754cd925132f7e920fd712e154208
MassLogger
b494f8418799f094e809de1bbce3970f01ae7f19a0db6c494d25656ae7a04d0a
MassLogger
c03621f1252606a61ffbccdbf821c68aea9c491df1968a49e21ce74258f0a5f2
MassLogger
e576e88eba32ee86d13bd2d490595abe936b78955d193d5523f0f5ad23c5ec9c
MassLogger
f4854fb409d136b74193144c50c888b36bbbbcde71b52acb5f8177a862ebd76c
MassLogger
+ 295 additional samples on MalwareBazaar
Result
Malware family:
masslogger
Create hunting rule
Score:
  10/10
Tags:
spyware stealer family:masslogger
Link:
https://tria.ge/reports/201010-g1yqnyecve/
Behaviour
Creates scheduled task(s)
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Looks up external IP address via web service
Checks computer location settings
Deletes itself
Reads user/profile data of web browsers
MassLogger
MassLogger Main Payload
Unpacked files
SH256 hash:
607f04646c9f16f7c23fa69d4b8f660fc7c44d40e4f73a0c70a2b315debdaa8b
MD5 hash:
a90baadadf904455325f7bc787185c7b
SHA1 hash:
7d833bb819d638008c98be469b05db2feaf201cd
Link:
https://www.unpac.me/results/67ddcb11-d762-488a-b50f-35581fbfb11a/
SH256 hash:
ac928cf443753c117a2eb1089f8abb492eb4aa8ba4f9c59180578b57ea63c728
MD5 hash:
571a245c88135a68ee1c986302a11d09
SHA1 hash:
95dabb92779d4581ebf68741544e6cf9541bc5c4
Link:
https://www.unpac.me/results/67ddcb11-d762-488a-b50f-35581fbfb11a/
SH256 hash:
d51f9483cab487c170bf1d61d1bee1bcb6f55fc613e0d4055d4c2a7d22b49e24
MD5 hash:
50b037885a3861778c6e6201dbd173b0
SHA1 hash:
c64e19e6f2eb9e25755b0570730cdaf4cbbaa84f
Detections:
win_masslogger_w0
Create hunting rule
Link:
https://www.unpac.me/results/67ddcb11-d762-488a-b50f-35581fbfb11a/
Parent samples :
0adc7e74c78f1d91fa1972467bdee948477ade15409a3f2924f337de4038ded1
2437a677dba9a82b9bc50f2d12c9682192d1150f8aac53e131a0913767c98a66
730a42a6d12942f236eefda66452c790e1f506ed57437342e3e0bdda9bf84143
1535da1a6d1565e52d0ee483302229d387ab7e33d9c9f07f745c6154c7de61e7
199653ca7cce2aabf2b54f899d29ab68526525a14487f0f1e02b45a0ad3e1f7c
102053c0be40cdc3daca5a7482b8572f5134e10bfe144137c64566a94a5e20b3
d040e74302a549e2c2332f16a05f21c2ccd5886604c3c785383b817d7c97fd07
630729fdd27776fa78d745320a153c105eeb7f40e8671515b3fd318ed4991bcb
1412ead7a7d061d4dbffd755b8ed9881da5ba163d90139df128fc4e4d26e93b6
d94d1cbec995584fc86297b547174128fa71a0e8b3b8de39183e8774cad65826
dbf19db7d0a4b842c4652e84edf70acbf1e1d2a9bd50403ba8fa0cd5abbba587
SH256 hash:
199653ca7cce2aabf2b54f899d29ab68526525a14487f0f1e02b45a0ad3e1f7c
MD5 hash:
5cba80940c9c4c465a4f437149f0dafe
SHA1 hash:
bcea10b21b7ae9b07aaa776292703df96161b78d
Link:
https://www.unpac.me/results/67ddcb11-d762-488a-b50f-35581fbfb11a/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/199653ca7cce2aabf2b54f899d29ab68526525a14487f0f1e02b45a0ad3e1f7c

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

rar 08b2481935ec3d358bd7c3c21c2f6ee23e97d69648584454b00cee66cb2869da

MassLogger

Executable exe 199653ca7cce2aabf2b54f899d29ab68526525a14487f0f1e02b45a0ad3e1f7c

(this sample)

  
Dropped by
MD5 b9c47d38782a5521dc9bf581eebfcaf0
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/69692/
  
Dropped by
SHA256 08b2481935ec3d358bd7c3c21c2f6ee23e97d69648584454b00cee66cb2869da

Comments