MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 227d27fd9d93676327684653aa83d4edb058bfd0e49d270c00a1c7fa134b5648. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 227d27fd9d93676327684653aa83d4edb058bfd0e49d270c00a1c7fa134b5648
SHA3-384 hash: f9d6fb83df8f1f6947814502d0086072d2d7e8fedce59c8a2bf9c8784ffb50c1e63278600e7a815db19d4c1f22b9369d
SHA1 hash: 252326da4408199a75ff3d0e99788ee2bf77c40b
MD5 hash: bebfb989828531d01c674e3c3287d93f
humanhash: mobile-florida-stream-ten
File name:BL2648372240.xls.exe
Download: download sample
Signature MassLogger
Create hunting rule
File size:838'352 bytes
First seen:2020-11-03 20:34:50 UTC
Last seen:2020-11-03 22:48:57 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 24576:h3Dp3dNAtXgGGIeU3OMFQH2Tk83LpNDb/41fiAD:V
Threatray 59 similar samples on MalwareBazaar
TLSH E7059EB875186CD1F56F4677DA9ABDD803B237538ACB98C88169B7C309A3371FE01849
Reporter James_inthe_box
Tags:exe MassLogger

Code Signing Certificate

Organisation:DigiCert Assured ID Root CA
Issuer:DigiCert Assured ID Root CA
Algorithm:sha1WithRSAEncryption
Valid from:Nov 10 00:00:00 2006 GMT
Valid to:Nov 10 00:00:00 2031 GMT
Serial number: 0CE7E0E517D846FE8FE560FC1BF03039
Intelligence: 22 malware samples on MalwareBazaar are signed with this code signing certificate
Thumbprint Algorithm:SHA256
Thumbprint: 3E9099B5015E8F486C00BCEA9D111EE721FABA355A89BCF1DF69561E3DC6325C
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
2
# of downloads :
117
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/82123/
Detection(s):
PUA.Win.Trojan.Generic-6629274-0
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a UDP request
Creating a window
Result
Threat name:
MassLogger RAT
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/519662
Signature
.NET source code contains very large array initializations
Adds a directory exclusion to Windows Defender
Machine Learning detection for dropped file
Machine Learning detection for sample
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file access)
Uses an obfuscated file name to hide its real file extension (double extension)
Uses nslookup.exe to query domains
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected Costura Assembly Loader
Yara detected MassLogger RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 308932 Sample: BL2648372240.xls.exe Startdate: 04/11/2020 Architecture: WINDOWS Score: 100 59 Multi AV Scanner detection for submitted file 2->59 61 Yara detected MassLogger RAT 2->61 63 .NET source code contains very large array initializations 2->63 65 8 other signatures 2->65 9 BL2648372240.xls.exe 15 8 2->9         started        14 nslookup.exe 14 3 2->14         started        process3 dnsIp4 51 elb097307-934924932.us-east-1.elb.amazonaws.com 23.21.252.4, 49742, 80 AMAZON-AESUS United States 9->51 53 nagano-19599.herokussl.com 9->53 55 api.ipify.org 9->55 41 C:\Users\user\AppData\...\nslookup.exe, PE32 9->41 dropped 43 C:\Users\user\...\BL2648372240.xls.exe.log, ASCII 9->43 dropped 73 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 9->73 75 Adds a directory exclusion to Windows Defender 9->75 16 cmd.exe 1 9->16         started        19 cmd.exe 1 9->19         started        21 powershell.exe 24 9->21         started        77 Machine Learning detection for dropped file 14->77 file5 signatures6 process7 signatures8 57 Uses nslookup.exe to query domains 16->57 23 nslookup.exe 16->23         started        27 conhost.exe 16->27         started        29 timeout.exe 1 16->29         started        31 conhost.exe 19->31         started        33 schtasks.exe 1 19->33         started        35 conhost.exe 21->35         started        process9 dnsIp10 45 184.73.247.141, 49765, 80 AMAZON-AESUS United States 23->45 47 nagano-19599.herokussl.com 23->47 49 2 other IPs or domains 23->49 67 Tries to steal Mail credentials (via file access) 23->67 69 Tries to harvest and steal browser information (history, passwords, etc) 23->69 71 Adds a directory exclusion to Windows Defender 23->71 37 powershell.exe 23->37         started        signatures11 process12 process13 39 conhost.exe 37->39         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/227d27fd9d93676327684653aa83d4edb058bfd0e49d270c00a1c7fa134b5648/
Threat name:
ByteCode-MSIL.Ransomware.TeslaCrypt
Create hunting rule
Status:
Malicious
First seen:
2020-11-03 20:32:58 UTC
File Type:
PE (.Net Exe)
Extracted files:
5
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ej6sp7m5sntwgj3iizj2va6u5wyfrp6q4sosodaauhd7ue2lkzea._file
Verdict:
unknown
Similar samples:
228264e8f57dc120e866db9789ed5cf7456a486024dcd6d83a60c0b02cc11158
MassLogger
25bfba7555f3b542adc0b1384711da8e2e44b5fa8141866eae52a3e81efb6954
MassLogger
29fbab8bb9b5126a998456269799b28b5e879b4f294e15feece36bb594b192c9
MassLogger
4988575523d9a0fe1fc226f972e930cf597cf8c001b306d07d7cc5750a45e38b
MassLogger
61a82a7cb29365a6ece69b6cdf60f03abec86782ede46e9d3908f122b2e251a5
MassLogger
669ad23d4fafbe02108540c3bfce8519a47d6c2d3198d085471de18b0a54b718
MassLogger
9ac4ff140a5b0cfe898c7f1eee2bc53cef1f4db03b7fc5c5f502d3a87f7c9393
MassLogger
a7df178348dd3563a0a0a44ec82af4b6bc15bf352337ef690fac078cfee6ec49
MassLogger
e630c1d94550061dccd1da06e50b378915870ce4630d646696e9b62fc1e9a8ff
MassLogger
f15b2f5c88a588fbeb079df8ca9c2e10180233df4a5d0b4165209e76bc456f4f
MassLogger
+ 49 additional samples on MalwareBazaar
Result
Malware family:
masslogger
Create hunting rule
Score:
  10/10
Tags:
family:masslogger spyware stealer
Link:
https://tria.ge/reports/201103-hrrt7yhn56/
Behaviour
Creates scheduled task(s)
Delays execution with timeout.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Looks up external IP address via web service
Checks computer location settings
Loads dropped DLL
Executes dropped EXE
MassLogger
MassLogger Main Payload
Unpacked files
SH256 hash:
227d27fd9d93676327684653aa83d4edb058bfd0e49d270c00a1c7fa134b5648
MD5 hash:
bebfb989828531d01c674e3c3287d93f
SHA1 hash:
252326da4408199a75ff3d0e99788ee2bf77c40b
Link:
https://www.unpac.me/results/066b4c80-5dc0-4f08-bcb7-008f40729a19/
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/82123/

Comments