MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1e86893e03f2f3bec014fc26e5fabd65fdfa2ddf14111707d0ef20dadf5bcef9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 9


Intelligence 9 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1e86893e03f2f3bec014fc26e5fabd65fdfa2ddf14111707d0ef20dadf5bcef9
SHA3-384 hash: 940f4c01bc5e3f6e59c63890bc7a9938798ea3012738ebcf226dd287922dff39ce0c11a18ff5186566432d8dc79db9b6
SHA1 hash: 69d0dbe78b72b4504df3d0b86c6179102cbae921
MD5 hash: 4fe4c85d2319e11340eda19d10139e31
humanhash: moon-sixteen-timing-lamp
File name:SecuriteInfo.com.Generic.mg.4fe4c85d2319e113.17989
Download: download sample
Signature MassLogger
Create hunting rule
File size:752'640 bytes
First seen:2020-11-30 21:51:43 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'663 x AgentTesla, 19'478 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:IjF/N1U63HQJq1Z4CucEtVM7C9kLKYCC2Cry0uUsFArgf:IBFWiw0X4cEt8C9vbC2oZsGrK
Threatray 561 similar samples on MalwareBazaar
TLSH 06F4E09C79C380F1C9950C7A5CC69E554B79CC10EA92CF4AF449392E9E393806E4BBF6
Reporter SecuriteInfoCom

Intelligence

File Origin
# of uploads :
1
# of downloads :
126
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/106137/
Detection(s):
SecuriteInfo.com.Generic.mg.4fe4c85d2319e113.17989.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a window
Using the Windows Management Instrumentation requests
Creating a file in the %AppData% subdirectories
Unauthorized injection to a recently created process
Creating a file
DNS request
Sending an HTTP GET request
Reading critical registry keys
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Setting a global event handler for the keyboard
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
MassLogger RAT MicroClip
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/551451
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code references suspicious native API functions
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file access)
Yara detected Costura Assembly Loader
Yara detected MassLogger RAT
Yara detected MicroClip
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 324839 Sample: SecuriteInfo.com.Generic.mg... Startdate: 30/11/2020 Architecture: WINDOWS Score: 100 44 Malicious sample detected (through community Yara rule) 2->44 46 Multi AV Scanner detection for dropped file 2->46 48 Multi AV Scanner detection for submitted file 2->48 50 8 other signatures 2->50 6 SecuriteInfo.com.Generic.mg.4fe4c85d2319e113.exe 1 6 2->6         started        10 vlc.exe 2 2->10         started        12 vlc.exe 3 2->12         started        process3 file4 24 C:\Users\user\AppData\Roaming\...\vlc.exe, PE32 6->24 dropped 26 C:\Users\user\...\vlc.exe:Zone.Identifier, ASCII 6->26 dropped 28 SecuriteInfo.com.G...85d2319e113.exe.log, ASCII 6->28 dropped 52 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 6->52 54 Injects a PE file into a foreign processes 6->54 14 SecuriteInfo.com.Generic.mg.4fe4c85d2319e113.exe 15 2 6->14         started        18 vlc.exe 10->18         started        20 vlc.exe 14 2 12->20         started        22 vlc.exe 12->22         started        signatures5 process6 dnsIp7 30 elb097307-934924932.us-east-1.elb.amazonaws.com 54.235.83.248, 49713, 49714, 80 AMAZON-AESUS United States 14->30 32 nagano-19599.herokussl.com 14->32 34 api.ipify.org 14->34 56 Tries to steal Mail credentials (via file access) 14->56 36 54.225.169.28, 49715, 80 AMAZON-AESUS United States 18->36 42 2 other IPs or domains 18->42 58 Tries to harvest and steal browser information (history, passwords, etc) 18->58 38 nagano-19599.herokussl.com 20->38 40 api.ipify.org 20->40 signatures8
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1e86893e03f2f3bec014fc26e5fabd65fdfa2ddf14111707d0ef20dadf5bcef9/
Threat name:
ByteCode-MSIL.Backdoor.Remcos
Create hunting rule
Status:
Malicious
First seen:
2020-11-30 17:48:27 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=d2dispqd6lz35qau7qtol6v5mx67ulo7cqirob6q54qnvx23z34q._file
Verdict:
malicious
Label(s):
masslogger
Create hunting rule
Similar samples:
0adc7e74c78f1d91fa1972467bdee948477ade15409a3f2924f337de4038ded1
MassLogger
1535da1a6d1565e52d0ee483302229d387ab7e33d9c9f07f745c6154c7de61e7
MassLogger
199653ca7cce2aabf2b54f899d29ab68526525a14487f0f1e02b45a0ad3e1f7c
MassLogger
3662a3b002337c0da8ad94925e3c183f0a2d35b0932f9d40b89643335f10564d
MassLogger
53683da1f2e21ec38952bbde9fd4e04330333cbda4185d1562f99ab31af17ea5
MassLogger
7220ad8192fd4399d114f8ba2c6ae7e7686e6a7e464dc4dc427a39609ab81c74
MassLogger
730a42a6d12942f236eefda66452c790e1f506ed57437342e3e0bdda9bf84143
MassLogger
8c3ea92bf0620d3126691eb0d463418170b88034e40dab26e8049ea5ceefd1f1
MassLogger
cc3b971f25d0ad410dbe3b7d1d6235041eb36632d0ea6e8d34a6a94e41d79df3
MassLogger
d040e74302a549e2c2332f16a05f21c2ccd5886604c3c785383b817d7c97fd07
MassLogger
+ 551 additional samples on MalwareBazaar
Result
Malware family:
masslogger
Create hunting rule
Score:
  10/10
Tags:
family:masslogger persistence spyware stealer
Link:
https://tria.ge/reports/201130-nbxnlj9pva/
Behaviour
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Adds Run key to start application
Looks up external IP address via web service
Checks computer location settings
Reads user/profile data of web browsers
MassLogger
MassLogger Main Payload
Unpacked files
SH256 hash:
1e86893e03f2f3bec014fc26e5fabd65fdfa2ddf14111707d0ef20dadf5bcef9
MD5 hash:
4fe4c85d2319e11340eda19d10139e31
SHA1 hash:
69d0dbe78b72b4504df3d0b86c6179102cbae921
Link:
https://www.unpac.me/results/0a0a45da-2eb9-4440-9fee-b7d9d8f5225e/
SH256 hash:
b7cfdd35a03045653d60db48f8eaee7e9cfaa27ce579fea08b9de4437ac15cb5
MD5 hash:
5d503ec6afdc4335bad944dbf5963f40
SHA1 hash:
0cbf572fff2b456892bd884845f7192af7d057a3
Detections:
win_masslogger_w0
Create hunting rule
Link:
https://www.unpac.me/results/0a0a45da-2eb9-4440-9fee-b7d9d8f5225e/
SH256 hash:
8e0c28f50678ebf362556369f702b25b31e6b175bcde65f12cb7fb72aadfb147
MD5 hash:
27d93c4dbab4337bb27ffa9eac95f97a
SHA1 hash:
a65b4c619a0bf42b5a22b39c117498310b4f9ed0
Link:
https://www.unpac.me/results/0a0a45da-2eb9-4440-9fee-b7d9d8f5225e/
SH256 hash:
83c08f0721c8b0c96e3d6a8f3ccaf5c96fbcc427d574625c34424c3429fefaa1
MD5 hash:
3c5dbcc3bb27e913e14efd8054811373
SHA1 hash:
b0eba9388abddaef9d5aa49ccd5dbab2924cced0
Link:
https://www.unpac.me/results/0a0a45da-2eb9-4440-9fee-b7d9d8f5225e/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Remcos
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1e86893e03f2f3bec014fc26e5fabd65fdfa2ddf14111707d0ef20dadf5bcef9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Keylog_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Contains Keylog
Rule name:masslogger_gcch
Create hunting rule
Author:govcert_ch
Rule name:Quasar_RAT_1
Create hunting rule
Author:Florian Roth
Description:Detects Quasar RAT
Reference:https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf
Rule name:win_masslogger_w0
Create hunting rule
Author:govcert_ch

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

MassLogger

Executable exe 1e86893e03f2f3bec014fc26e5fabd65fdfa2ddf14111707d0ef20dadf5bcef9

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/870401/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/106137/

Comments