MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1c38c575d183cb82453a4a0a45053f6586e28660bae7d24cb3f7ae33d151c7eb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

MassLogger

Vendor detections: 5

Intelligence 5 IOCs YARA 2 File information Comments

SHA256 hash:	1c38c575d183cb82453a4a0a45053f6586e28660bae7d24cb3f7ae33d151c7eb
SHA3-384 hash:	52307cad1896ae55c6e205c5acd18374696f2c9751b351d8dd40349e99bc0e3f580d043c4670d619e89cb3100b4f9ffd
SHA1 hash:	46eb99c0a72efff5fe8245a1376a8ec70ea0f274
MD5 hash:	91b019800f5377f7d3b7f999fb8be78e
humanhash:	mobile-charlie-failed-lake
File name:	tbwbewrqwxeqwe.dll
Download:	download sample
Signature	MassLogger Create hunting rule
File size:	189'952 bytes
First seen:	2021-09-02 19:36:55 UTC
Last seen:	Never
File type:	dll
MIME type:	application/x-dosexec
imphash	dae02f32a21e03ce65412f6e56942daa (123 x YellowCockatoo, 60 x CobaltStrike, 44 x JanelaRAT)
ssdeep	3072:LKzCfzD1DpRYLK2bSfSEQMZZHwSTenhwEif:LKefzD1DpIKlf/4v
Threatray	629 similar samples on MalwareBazaar
TLSH	T1F004E6E013ABDE22EBEE8778D0A10517E7EC8A469962F758780451E15C07353E583BEF
Reporter	AndreGironda
Tags:	aggah dll hagga MassLogger zgRAT

AndreGironda

Code Import of DotNet :

Microsoft.CSharp.CSharpCodeProvider.CompileAssemblyFromSource -- CodeDom $RUNPE "projFUD.PA" "Execute"
csc.exe /platform:X86 /unsafe /target:library

Intelligence

File Origin

# of uploads :

# of downloads :

142

Origin country :

n/a

Vendor Threat Intelligence

Detection:

zgRAT

Link:

https://www.capesandbox.com/analysis/184961/

Result

Verdict:

Clean

Maliciousness:

Behaviour

DNS request

Sending a UDP request

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/7852b5b9-ed00-4067-9ab1-bcca1f4954d9

Result

Threat name:

Unknown

Detection:

malicious

Classification:

evad

Score:

56 / 100

Link:

https://www.joesandbox.com/analysis/844311

Signature

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code references suspicious native API functions

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/1c38c575d183cb82453a4a0a45053f6586e28660bae7d24cb3f7ae33d151c7eb/

Threat name:

Win32.Trojan.Sabsik

Status:

Malicious

First seen:

2021-08-31 22:46:57 UTC

AV detection:

13 of 28 (46.43%)

Threat level:

5/5

Verdict:

malicious

Label(s):

masslogger

MassLogger

6d9aaf59f30c370edf5921da5c9085d00c826c01af55e8dde046b08b2573d8f2

MassLogger

8bd39d451b99909467edb3df6618762071da426ee580108882e300cf8b21b0cb

MassLogger

912600bd6e63f251f04f033d78b5bf9df23c207bef9715bdd6d4949c9f25b65c

MassLogger

9b19c9209b2ae45df8c1d9d9f9b4e00f3d6c9edfb4ff64578d06a5a3f0a099e2

MassLogger

9f999d5b44ff7bd243bc33f8a89f504c95d6b21eef26b7b80a49715471ff43d3

MassLogger

9fb2e0b5f09a7d3d66195fbaa6e7055cba4331ca2563305fc32104c82a978aa9

MassLogger

b7aa7cbd8c966e98aae89ea2f4e8f485b8969f99349c9899dfbbe9a51bcd0e91

MassLogger

ca74ca06ac3bfd92aabfc85fc7e10ae5d9e2e6306ed488eb7bf0b06640890a9f

MassLogger

ebfa0ae13cafa77bd2f1da27f39b9a929e101ae2a5633b1b248d7131bcb25ee4

MassLogger

+ 619 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

1/10

Tags:

n/a

Link:

https://tria.ge/reports/210902-ybtbjsefdj/

Behaviour

Suspicious use of WriteProcessMemory

Unpacked files

SH256 hash:

1c38c575d183cb82453a4a0a45053f6586e28660bae7d24cb3f7ae33d151c7eb

MD5 hash:

91b019800f5377f7d3b7f999fb8be78e

SHA1 hash:

46eb99c0a72efff5fe8245a1376a8ec70ea0f274

Link:

https://www.unpac.me/results/bce74825-661e-449c-8d4f-9aa337a5f10d/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.14

Link:

https://yomi.yoroi.company/submissions/1c38c575d183cb82453a4a0a45053f6586e28660bae7d24cb3f7ae33d151c7eb

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	extracted_at_0x44b Create hunting rule
Author:	cb
Description:	sample - file extracted_at_0x44b.exe
Reference:	Internal Research

Rule name:	INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture Create hunting rule
Author:	ditekSHen
Description:	Detect executables with stomped PE compilation timestamp that is greater than local current time