MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1f6ec588edbf2a5b1796f89ad775229cad1066bc93607baa8993a19323be34e8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

MassLogger

Vendor detections: 9

Intelligence 9 IOCs YARA 2 File information Comments

SHA256 hash:	1f6ec588edbf2a5b1796f89ad775229cad1066bc93607baa8993a19323be34e8
SHA3-384 hash:	3120b75b30a17fe7cdc299dbccf3cef046dcbc776dac8b73fa4aca90b0cbae438c582936aae3a0e3c7fd42b0a3c5aefd
SHA1 hash:	1e297c7dddf8b2f8a7926e5f919d4e8425d939ee
MD5 hash:	68c9a34cdd336470e03189833903963d
humanhash:	carbon-zulu-finch-jersey
File name:	INVOICE-ORDERP-I_ INDUSTRIAL SUPPLYINGS23434_pdf.exe
Download:	download sample
Signature	MassLogger Create hunting rule
File size:	1'761'672 bytes
First seen:	2020-10-19 09:58:20 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'452 x Formbook, 12'201 x SnakeKeylogger)
ssdeep	24576:ocK+UHA4m+Sidi6GsgeUzyr3u5UvG108mIOW8oEmz:o/yid7GsgZy3uNUtW8oEmz
Threatray	167 similar samples on MalwareBazaar
TLSH	C185B12439FA904DF273AF7A9ED471A69A2BF7733606946D205183070A13A83DFC953D
Reporter	abuse_ch
Tags:	exe MassLogger

abuse_ch

Malspam distributing MassLogger:

HELO: my.dataparadise.in
Sending IP: 208.187.163.109
From: bhavesh@grainsplusimportexport.com
Subject: Re: PROFORM INVOICE
Attachment: INVOICE-ORDERP-I_ INDUSTRIAL SUPPLYINGS23434_pdf.lzh (contains "INVOICE-ORDERP-I_ INDUSTRIAL SUPPLYINGS23434_pdf.exe")

MassLogger SMTP exfil server:
mail.digitalprint.hr:587

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/72846/

Detection(s):

Win.Dropper.Temonde-6571898-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a UDP request

DNS request

Sending an HTTP GET request

Using the Windows Management Instrumentation requests

Creating a window

Launching a process

Reading critical registry keys

Setting a global event handler for the keyboard

Result

Threat name:

MassLogger RAT

Detection:

malicious

Classification:

troj.spyw.evad

Score:

96 / 100

Link:

https://www.joesandbox.com/analysis/495172

Signature

Adds a directory exclusion to Windows Defender

Initial sample is a PE file and has a suspicious name

Malicious sample detected (through community Yara rule)

May check the online IP address of the machine

Multi AV Scanner detection for submitted file

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file access)

Yara detected Costura Assembly Loader

Yara detected MassLogger RAT

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/1f6ec588edbf2a5b1796f89ad775229cad1066bc93607baa8993a19323be34e8/

Threat name:

ByteCode-MSIL.Trojan.Variadic

Status:

Malicious

First seen:

2020-10-19 06:09:08 UTC

AV detection:

21 of 27 (77.78%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=d5xmlchnx4vfwf4w7cnno5jctswrazv4snqhxkujsoqzgi56gtua._file

Verdict:

malicious

Label(s):

agenttesla

MassLogger

1e9ff9549343dcb17dcb137508657a94e5503579e0e0741443b27c732b62fa5c

MassLogger

55bca504c5ff798d6c5d4431eff4dda8df6ebfca0db4d86b0f1bf770ff550a0f

MassLogger

8f9f89be357d1d17b6281bf9f6caebfa97fdbfcb6aec50e4aa147d0e24e909e7

MassLogger

92715192ee868e9d408f9449893688c609bb81fb522f9af00f9cf8caeaf098a2

MassLogger

9b915d2e5f70b859d8c2eafc94bd593d3e53255444a5b4b651dfb9c2523d83d7

MassLogger

c0b81523511df7b87111c6d4d849f08326e22a15adeb15a203feb8ce5ca56a75

MassLogger

c2c89da1518a4950cedec3129aa86fce21ccec502586e44a7f3b3757b44a1e1c

MassLogger

eed41a2c1215d2ca0ef2022172504a565b7a968e6263e173fceb6f1b1747d795

MassLogger

f4c25b70ae9ea0c7f4a7f028011167b7154ded11a0b8e90b1c7570ba9af1f2f2

MassLogger

+ 157 additional samples on MalwareBazaar

Result

Malware family:

masslogger

Score:

10/10

Tags:

spyware stealer family:masslogger

Link:

https://tria.ge/reports/201019-4ry769xmss/

Behaviour

Suspicious behavior: AddClipboardFormatListener

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Looks up external IP address via web service

Checks computer location settings

Reads user/profile data of web browsers

MassLogger

MassLogger Main Payload

Unpacked files

SH256 hash:

1f6ec588edbf2a5b1796f89ad775229cad1066bc93607baa8993a19323be34e8

MD5 hash:

68c9a34cdd336470e03189833903963d

SHA1 hash:

1e297c7dddf8b2f8a7926e5f919d4e8425d939ee

Detections:

win_masslogger_w0

Link:

https://www.unpac.me/results/e44cb640-c44b-45ea-a301-a3d089e30764/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

MassLogger

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/1f6ec588edbf2a5b1796f89ad775229cad1066bc93607baa8993a19323be34e8

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.