MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3a61c2e77a0e22e3d7958ef355b88e21b73986ab5e0f2e6dedf7e3d77691e0d6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

MassLogger

Vendor detections: 6

Intelligence 6 IOCs YARA 3 File information Comments

SHA256 hash:	3a61c2e77a0e22e3d7958ef355b88e21b73986ab5e0f2e6dedf7e3d77691e0d6
SHA3-384 hash:	84c8ca4f035f6d42495cfec569f85cfdf5274a5cc5ace247f1b1b9757237a5f35e7c4178507c3f44b8317e925a3ff6c8
SHA1 hash:	1317a3991c88a4dec904cb0dc8dffdb47dcb08e0
MD5 hash:	cc89c56a663c9856498e02afb4b272ec
humanhash:	snake-louisiana-pluto-zulu
File name:	Halkbank,pdf.exe
Download:	download sample
Signature	MassLogger Create hunting rule
File size:	1'198'080 bytes
First seen:	2020-09-11 11:18:11 UTC
Last seen:	2020-09-11 11:41:57 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'454 x Formbook, 12'202 x SnakeKeylogger)
ssdeep	12288:MIm8u8r9oxpGIzq1q41GQg9P4nSNRuslSO0c+1aUxPDqFT/UnQhjJjRLxWl7MAaw:U8x9omKn9PAp2L+1tDe/U6jzQl7MAkd
Threatray	214 similar samples on MalwareBazaar
TLSH	F945E0403AA94B06D1F47BF0182A709437B93DD56825FE0F2E8579DF2933B91A2D2637
Reporter	GovCERT_CH
Tags:	MassLogger

Intelligence

File Origin

# of uploads :

# of downloads :

120

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/58657/

Detection(s):

SecuriteInfo.com.Trojan.GenericKD.34506288.27468.22577.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Sending a UDP request

Unauthorized injection to a recently created process

Creating a file

DNS request

Sending an HTTP GET request

Using the Windows Management Instrumentation requests

Reading critical registry keys

Setting a global event handler for the keyboard

Result

Threat name:

MassLogger RAT

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/464111

Signature

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code references suspicious native API functions

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Injects a PE file into a foreign processes

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

May check the online IP address of the machine

Multi AV Scanner detection for submitted file

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to steal Mail credentials (via file access)

Yara detected Costura Assembly Loader

Yara detected MassLogger RAT

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/3a61c2e77a0e22e3d7958ef355b88e21b73986ab5e0f2e6dedf7e3d77691e0d6/

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2020-09-11 03:55:38 UTC

AV detection:

21 of 29 (72.41%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=hjq4fz32byrohv4vr3zvloeoeg3ttbvllyhs43pn67r5o5ur4dla._file

Verdict:

unknown

MassLogger

72ceeee6538d869e032d33c4cac0b1e51f34b9e32bf1e17f475b5609ddfe0bf8

MassLogger

7d85dcd63ce189a5b1ab36d5c18063a1a2bf20204d93d1e21c35d825cf4a2585

MassLogger

8bd39d451b99909467edb3df6618762071da426ee580108882e300cf8b21b0cb

MassLogger

bf6685f531efdf06db86ed0e735fcbe612858213677111ad900a02164cd77efd

MassLogger

c0c4c97332bfb8b5254c089e82c05d0a7d171747b72f991f7e3bdb2ed74856d0

MassLogger

dc0087097e433036c00aaf8751d4cd9dc3e309fdba09c2ee1415a4060aa1cced

MassLogger

dd652810ff0fc0288768ac20d5fcc76f7bc517c3ed8b066a18340a8b69c69c3a

MassLogger

eea0d77f48f92940ec6825df3ab5bcedb6aa9112d02f101ee4b0392f5bb3dc6d

MassLogger

f7c3a696b7b725636165a5089679d0766a2d2b6134464032db75738781f55f57

MassLogger

+ 204 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

7/10

Tags:

spyware

Link:

https://tria.ge/reports/200911-35ak9e5bf2/

Behaviour

Suspicious behavior: AddClipboardFormatListener

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious behavior: AddClipboardFormatListener

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Looks up external IP address via web service

Checks computer location settings

Reads user/profile data of web browsers

Checks computer location settings

Reads user/profile data of web browsers

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Kryptik

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/3a61c2e77a0e22e3d7958ef355b88e21b73986ab5e0f2e6dedf7e3d77691e0d6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	masslogger_gcch Create hunting rule
Author:	govcert_ch

Rule name:	Quasar_RAT_1 Create hunting rule
Author:	Florian Roth
Description:	Detects Quasar RAT
Reference:	https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf