MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 31a02cdd0d7e578a470fb434aafab1f8005da0dc356bce10f38c5e617b659ae3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
MassLogger
Vendor detections: 8
| SHA256 hash: | 31a02cdd0d7e578a470fb434aafab1f8005da0dc356bce10f38c5e617b659ae3 |
|---|---|
| SHA3-384 hash: | 5ec9f781722f5e9cfac0875096b9306b91262b6aee9459727cfd4fc1211c0131b47800c2a71436d128b31f29bf2895d2 |
| SHA1 hash: | 6897188f6f4a365a64675cb6fe31ca0a5e2b65b9 |
| MD5 hash: | 86d15b73cf9ea80263848169368ebed0 |
| humanhash: | solar-speaker-october-coffee |
| File name: | scandocuments_pdf.exe |
| Download: | download sample |
| Signature | MassLogger |
| File size: | 793'088 bytes |
| First seen: | 2020-11-05 10:07:50 UTC |
| Last seen: | 2020-11-05 11:51:39 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'663 x AgentTesla, 19'478 x Formbook, 12'208 x SnakeKeylogger) |
| ssdeep | 24576:t/z0IzdNe1jaElPdKZSaR9bVh4oM2WiG9KCeuZSnz: |
| Threatray | 4 similar samples on MalwareBazaar |
| TLSH | B4F4AFB875146CD6F66F467BDA96BDD803B23653CAC768C88168B7C305A3375FE02809 |
| Reporter |  abuse_ch |
| Tags: | exe MassLogger |
abuse_ch
Malspam distributing unidentified malware:HELO: victim-domain
Sending IP: 45.137.22.74
From: info@victim-domain
Subject: URGENT
Attachment: scandocuments_pdf.7z (contains "scandocuments_pdf.exe")
Intelligence
File Origin
# of uploads :
2
# of downloads :
100
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Detection(s):
Result
Verdict:
Malware
Maliciousness:
Behaviour
Sending a UDP request
DNS request
Sending an HTTP GET request
Using the Windows Management Instrumentation requests
Creating a window
Launching a process
Reading critical registry keys
Sending a custom TCP request
Setting a global event handler for the keyboard
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
MassLogger RAT
Detection:
malicious
Classification:
troj.spyw.evad
Score:
92 / 100
Signature
Adds a directory exclusion to Windows Defender
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file access)
Yara detected Costura Assembly Loader
Yara detected MassLogger RAT
Behaviour
Behavior Graph:
Threat name:
ByteCode-MSIL.Infostealer.Fareit
Status:
Malicious
First seen:
2020-11-05 02:18:40 UTC
AV detection:
25 of 29 (86.21%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
unknown
Similar samples:
Result
Malware family:
masslogger
Score:
10/10
Tags:
family:masslogger spyware stealer
Behaviour
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Looks up external IP address via web service
Checks computer location settings
Reads user/profile data of web browsers
MassLogger
MassLogger Main Payload
Unpacked files
SH256 hash:
31a02cdd0d7e578a470fb434aafab1f8005da0dc356bce10f38c5e617b659ae3
MD5 hash:
86d15b73cf9ea80263848169368ebed0
SHA1 hash:
6897188f6f4a365a64675cb6fe31ca0a5e2b65b9
SH256 hash:
4ed4421cb947e648ce55b428cb1a08aaec9c7e1b603d56b5b89c605eecd0ffbf
MD5 hash:
e78927a8bd0e9663d95939314b2ddca1
SHA1 hash:
50bc4aa6eb2178034db3df9aaae93e59b5f45af3
SH256 hash:
544cf8d6781340c605a618df684070da05cda724b22f57be9f28b2d66c602551
MD5 hash:
4ace32df535c8370fabf10d145b9e90b
SHA1 hash:
6369f94be7e26e55986c92bcdba331d63f04ac98
SH256 hash:
a7aeccd2476996dc2560dce32e64a30ee1548b50613179cd09dbd40af78a6b24
MD5 hash:
d9a7c425884fbfedaa240a01e80c4f0f
SHA1 hash:
8088f11da7122f5b5456921433f9e4bf5e4eff14
Detections:
win_masslogger_w0
Parent samples :
cf0a2b8b7dec5f0d797d99927037af3f61146da547bf599127636a24753c8caf
31a02cdd0d7e578a470fb434aafab1f8005da0dc356bce10f38c5e617b659ae3
14dba4e8c0740eb49fe53948d4158b4d8a32e2d430fbcf7d0b0f7c9033f98808
b3e57c1a313d01a7faea074079db176b05339299a907a7bda05432d567739205
c438704d1c73d3449ce3c2e5de4fa32747d5e61f20e15c4f9da0c006d656c520
31a02cdd0d7e578a470fb434aafab1f8005da0dc356bce10f38c5e617b659ae3
14dba4e8c0740eb49fe53948d4158b4d8a32e2d430fbcf7d0b0f7c9033f98808
b3e57c1a313d01a7faea074079db176b05339299a907a7bda05432d567739205
c438704d1c73d3449ce3c2e5de4fa32747d5e61f20e15c4f9da0c006d656c520
SH256 hash:
a85d3fa2b93db35013fb3b0885d512249a96f16889f33e0f339b2c9ff400a604
MD5 hash:
e444952b7e8d26d39280af5814bf86bc
SHA1 hash:
cf139246c9a642b8e067954ad099161a51e755e4
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.