MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 1eede2e64187f350be4bad955f78c8f3aa82939639bde4a72f98bfd8bd796a61. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
MassLogger
Vendor detections: 6
| SHA256 hash: | 1eede2e64187f350be4bad955f78c8f3aa82939639bde4a72f98bfd8bd796a61 |
|---|---|
| SHA3-384 hash: | f71507ff304ffec7937479f30e11f936540e45b6b76ac1adb32e8a678a92e1a7fe24fdb10e658f310e52b65c6918f438 |
| SHA1 hash: | f1e85860bc5012fd4d0a38ac13eac1d80ff88bb9 |
| MD5 hash: | fa04b31372d510c7d94b87d33dbb6812 |
| humanhash: | montana-speaker-vegan-carbon |
| File name: | s9gPsAfxEpCcR3f.exe |
| Download: | download sample |
| Signature | MassLogger |
| File size: | 1'054'720 bytes |
| First seen: | 2020-10-20 06:14:57 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'658 x AgentTesla, 19'469 x Formbook, 12'208 x SnakeKeylogger) |
| ssdeep | 24576:t4APxpvUMo+ixTi0INqOVRHwz87h7pIFe7xBziexShg6F8YSx:dPOxONNqOAY7h7mCx9ieshxe |
| Threatray | 194 similar samples on MalwareBazaar |
| TLSH | 42251270228A9F64E13D737B30A6502013F6A8C5DB61DF2A7FD677F614A3F4052A2A1D |
| Reporter |  abuse_ch |
| Tags: | exe GarantiBBVA geo MassLogger TUR |
abuse_ch
Malspam distributing unidentified malware:HELO: m1mkyc5j.ni.net.tr
Sending IP: 89.252.168.52
From: Garanti BBVA Emeklilik <OtomatikBES@garantibbvaemeklilik.com.tr>
Reply-To: noreply <mintchin1@gmail.com>
Subject: Otomatik BES İşlemleri Son Aşama - Ödeme Dosyanızı Yükleyin
Attachment: 2020-10-19....rar (contains "s9gPsAfxEpCcR3f.exe")
Intelligence
File Origin
# of uploads :
1
# of downloads :
102
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Result
Verdict:
Malware
Maliciousness:
Behaviour
Sending a UDP request
Creating a window
Result
Threat name:
MassLogger RAT
Detection:
malicious
Classification:
troj.evad
Score:
80 / 100
Signature
.NET source code contains potential unpacker
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected AntiVM_3
Yara detected MassLogger RAT
Behaviour
Behavior Graph:
Threat name:
ByteCode-MSIL.Trojan.Ymacco
Status:
Malicious
First seen:
2020-10-19 17:06:18 UTC
AV detection:
22 of 28 (78.57%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
suspicious
Similar samples:
+ 184 additional samples on MalwareBazaar
Unpacked files
SH256 hash:
1eede2e64187f350be4bad955f78c8f3aa82939639bde4a72f98bfd8bd796a61
MD5 hash:
fa04b31372d510c7d94b87d33dbb6812
SHA1 hash:
f1e85860bc5012fd4d0a38ac13eac1d80ff88bb9
SH256 hash:
a180f225fc1c8215bafe4a6faa5252a78ebbb8ce2c19c97b48622e3eb6dad665
MD5 hash:
71de2019c752c2059bae2565197da4a4
SHA1 hash:
064e3453aa4395629b49ad53e53ef28259e34d5c
SH256 hash:
e5009b34bddaab2a163b6f5e252f0d47310c94a9eb9150bf7823c95f2d157d84
MD5 hash:
88753aa9305fb14477481a510c9c9c52
SHA1 hash:
e39739acc3b8ca5d61bd623fec16069e3b8ef568
Detections:
win_masslogger_w0
SH256 hash:
bac5797bde4b2810766a40d95bcdb825ac5b395fcbadd139daa19a44a6cdc049
MD5 hash:
a92cc1f6e0a2742350dfda6726db14c0
SHA1 hash:
e5404e3ed46498deb8ad8966a774540c2b8e9c1e
SH256 hash:
f2fefeb11806ad47d9dbbbeba2cefb3dc88f2b3851dbb4bc57194fd55cebaf36
MD5 hash:
3f967838d046cc4e7c3d3c44aaa3a040
SHA1 hash:
e55eef233d240e8807e31954f008d186797feba8
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.45
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.