MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2ceab306e59f18b38542e68048836fc925d2563610809247b4a7d3f38678cbea. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2ceab306e59f18b38542e68048836fc925d2563610809247b4a7d3f38678cbea
SHA3-384 hash: 88ebe421a844994b9dcfae2e5df92910d4271cb1f1f574b01e4df79c66defc9070518eb3a2e0ef95ad54b28d4b460143
SHA1 hash: e6605ed4dfe57e98dd96b219c4a820726920d6cd
MD5 hash: dfbd331e7ccf1a81dd057a638ceba998
humanhash: ohio-social-spring-vermont
File name:2ceab306e59f18b38542e68048836fc925d2563610809247b4a7d3f38678cbea
Download: download sample
Signature MassLogger
Create hunting rule
File size:2'175'768 bytes
First seen:2020-11-16 10:49:01 UTC
Last seen:2020-11-16 12:44:41 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'658 x AgentTesla, 19'469 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 49152:09LV/TyYlYyBoQq7qyCxSOs1UHlQNUpUiD7+BgwoY1Qq:0HflsQq7qyzOKUHkUN+uwoNq
Threatray 1'510 similar samples on MalwareBazaar
TLSH C8A502AA720ACF39C4B51833C0C7A61613B16C53517EE6777981326536227E94CABBCF
Reporter JAMESWT_WT
Tags:Foxstyle LLC MassLogger signed

Intelligence

File Origin
# of uploads :
2
# of downloads :
109
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Variant.Bulz.65418.16168.30520.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Creating a file
Running batch commands
Creating a process with a hidden window
Launching a process
Adding an access-denied ACE
Moving of the original file
Enabling autorun by creating a file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/537523
Signature
.NET source code contains method to dynamically call methods (often used by packers)
Antivirus / Scanner detection for submitted sample
Binary is likely a compiled AutoIt script file
Injects a PE file into a foreign processes
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected AntiVM_3
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 317859 Sample: CHPCV5iXaC Startdate: 16/11/2020 Architecture: WINDOWS Score: 84 50 Antivirus / Scanner detection for submitted sample 2->50 52 Multi AV Scanner detection for submitted file 2->52 54 Yara detected AntiVM_3 2->54 56 4 other signatures 2->56 10 CHPCV5iXaC.exe 3 2->10         started        13 keymgr.exe 2 2->13         started        16 keymgr.exe 3 2->16         started        18 keymgr.exe 2 2->18         started        process3 file4 48 C:\Users\user\AppData\...\CHPCV5iXaC.exe.log, ASCII 10->48 dropped 20 CHPCV5iXaC.exe 1 10->20         started        22 CHPCV5iXaC.exe 10->22         started        24 CHPCV5iXaC.exe 10->24         started        58 Injects a PE file into a foreign processes 13->58 26 keymgr.exe 13->26         started        28 keymgr.exe 13->28         started        30 keymgr.exe 16->30         started        32 keymgr.exe 18->32         started        signatures5 process6 process7 34 cmd.exe 1 20->34         started        process8 36 icacls.exe 1 34->36         started        38 conhost.exe 34->38         started        40 icacls.exe 1 34->40         started        42 icacls.exe 1 34->42         started        process9 44 MpCmdRun.exe 36->44         started        process10 46 conhost.exe 44->46         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2ceab306e59f18b38542e68048836fc925d2563610809247b4a7d3f38678cbea/
Threat name:
ByteCode-MSIL.Ransomware.TeslaCrypt
Create hunting rule
Status:
Malicious
First seen:
2020-08-26 22:01:22 UTC
File Type:
PE (.Net Exe)
Extracted files:
28
AV detection:
22 of 28 (78.57%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
masslogger
Create hunting rule
Similar samples:
1915126c27ba8566c624491bd2613215021cc2b28e5e6f3af69e9e994327f3ac
MassLogger
23ef17c8a9fbcb6c35549aff9263566bec6e3fbc61e6bdfb9715d2595a1ee003
MassLogger
6cebbb0e3d8d28117e67f18212a9847d0262fd4e616def639be1071f1c33b8fb
MassLogger
6d1cfff093998c807b9c5dc3fd122adbea40c5bad0cad4cbe10b43932c28bdd9
MassLogger
b254d7faa603b46c4c63f6d1f88d65767fb80638a000967fe527b9572b956e35
MassLogger
b2c546db519f541e77933c1ae7884047df59775c05488c766a5b1b96eff1cb79
MassLogger
c1f0ba6302099b8f7ef1ce28a333764efdd308cccc761ba4fcef2af386f13090
MassLogger
c3ecd490c37b81d4675c4f57cb6417e62edf45e4ce6890dc7ae7fc99d3ab207e
MassLogger
db6c57acf61c5e3fc79190feca4683089f6a05b8af985e49361d25995178e4d0
MassLogger
e942c853f791a2ebd37ae59344bf8878d9a02cdcb83848a68876c49497c642d2
MassLogger
+ 1'500 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
discovery
Link:
https://tria.ge/reports/201116-vb6sn8rz36/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: RenamesItself
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Modifies file permissions
Executes dropped EXE
Unpacked files
SH256 hash:
9577e7bd44a4e6234c49321f74acc763781a8b5b84f0f087dda341a6dd4be49d
MD5 hash:
87244046c6a667292042bd9953d31483
SHA1 hash:
8cb5bc3e3157d0a5e6b0b6f9c983125fea211c58
Link:
https://www.unpac.me/results/04f66d22-67c2-4d27-b2f3-3d27c2874ffa/
SH256 hash:
3bc44a84b8470abd8e3e9c48a6630d1b004640846590edd4eb02b979e7b984bc
MD5 hash:
5ea1fea3444e3edde73122e5524f684d
SHA1 hash:
ad60778ae7cdbe4666b9c8a58ad547d40a909553
Link:
https://www.unpac.me/results/04f66d22-67c2-4d27-b2f3-3d27c2874ffa/
SH256 hash:
2ceab306e59f18b38542e68048836fc925d2563610809247b4a7d3f38678cbea
MD5 hash:
dfbd331e7ccf1a81dd057a638ceba998
SHA1 hash:
e6605ed4dfe57e98dd96b219c4a820726920d6cd
Link:
https://www.unpac.me/results/04f66d22-67c2-4d27-b2f3-3d27c2874ffa/
SH256 hash:
b06e149ae34b452a51415ac773752c8b8ee2dfc3717373ca9d96a6f72f3306fd
MD5 hash:
d7259e527568e862044ea67328836ba3
SHA1 hash:
ef32a0367a21391cf8f9d9628cb00ffee808acc4
Link:
https://www.unpac.me/results/04f66d22-67c2-4d27-b2f3-3d27c2874ffa/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AutoIT_Compiled
Create hunting rule
Author:@bartblaze
Description:Identifies compiled AutoIT script (as EXE).

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments