MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3cb1955eec13265edab82971675922208f0ef9d05ee1107bc321be2eb6633ef2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 9


Intelligence 9 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3cb1955eec13265edab82971675922208f0ef9d05ee1107bc321be2eb6633ef2
SHA3-384 hash: e3c8d63d6a1dfbfaba11375b4d7c1b48b204eb381a4ac28f5bb14dc1b3f23ed04cdb46ecc0b58ba532b1ca02d7354ff0
SHA1 hash: 247a757e0a66ed2b6fe263d2e87231f45de89431
MD5 hash: d54d01d0a3a073d1d2a3b70e0d9852cc
humanhash: september-apart-london-johnny
File name:d54d01d0a3a073d1d2a3b70e0d9852cc.exe
Download: download sample
Signature MassLogger
Create hunting rule
File size:1'191'936 bytes
First seen:2020-11-18 11:12:33 UTC
Last seen:2020-11-18 13:20:37 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'461 x Formbook, 12'202 x SnakeKeylogger)
ssdeep 24576:pvBhN6aQAL57qWotEfjt+V4+HxI0eCsN1NuoWUCTXDy9NlCbt:pvBhoLg51otaYV4+R/sNu4CTXDyxCb
Threatray 542 similar samples on MalwareBazaar
TLSH 3645F190364442D7EDB889322316F2B10A132CBFC7ADF65570D43B1B2A753CE9961BE9
Reporter abuse_ch
Tags:exe MassLogger


Avatar
abuse_ch
MassLogger SMTP exfil server:
mail.privateemail.com:587

Intelligence

File Origin
# of uploads :
2
# of downloads :
107
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Inject4.5349.23516.20188.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a window
Creating a file in the %AppData% subdirectories
Unauthorized injection to a recently created process
Creating a file
DNS request
Sending an HTTP GET request
Using the Windows Management Instrumentation requests
Reading critical registry keys
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Setting a global event handler for the keyboard
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
MassLogger RAT
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/540903
Signature
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file access)
Yara detected Costura Assembly Loader
Yara detected MassLogger RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 319551 Sample: Y3QtMS4jOp.exe Startdate: 18/11/2020 Architecture: WINDOWS Score: 100 42 Malicious sample detected (through community Yara rule) 2->42 44 Multi AV Scanner detection for dropped file 2->44 46 Multi AV Scanner detection for submitted file 2->46 48 7 other signatures 2->48 6 Y3QtMS4jOp.exe 1 6 2->6         started        10 vlc.exe 3 2->10         started        12 vlc.exe 2 2->12         started        process3 file4 22 C:\Users\user\AppData\Roaming\...\vlc.exe, PE32 6->22 dropped 24 C:\Users\user\...\vlc.exe:Zone.Identifier, ASCII 6->24 dropped 26 C:\Users\user\AppData\...\Y3QtMS4jOp.exe.log, ASCII 6->26 dropped 50 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 6->50 52 Injects a PE file into a foreign processes 6->52 14 Y3QtMS4jOp.exe 15 2 6->14         started        18 vlc.exe 14 2 10->18         started        20 vlc.exe 12->20         started        signatures5 process6 dnsIp7 28 elb097307-934924932.us-east-1.elb.amazonaws.com 54.225.66.103, 49748, 49759, 80 AMAZON-AESUS United States 14->28 30 nagano-19599.herokussl.com 14->30 32 api.ipify.org 14->32 54 Tries to steal Mail credentials (via file access) 14->54 38 2 other IPs or domains 18->38 56 Tries to harvest and steal browser information (history, passwords, etc) 18->56 34 54.225.153.147, 49761, 80 AMAZON-AESUS United States 20->34 36 192.168.2.1 unknown unknown 20->36 40 2 other IPs or domains 20->40 signatures8
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3cb1955eec13265edab82971675922208f0ef9d05ee1107bc321be2eb6633ef2/
Threat name:
ByteCode-MSIL.Trojan.DelShad
Create hunting rule
Status:
Malicious
First seen:
2020-11-18 02:59:18 UTC
AV detection:
20 of 28 (71.43%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=hsyzkxxmcmtf5wvyffywowjcechq56oql3qra66deg7c5ntdh3za._file
Verdict:
malicious
Label(s):
masslogger
Create hunting rule
Similar samples:
2268c04275e6483759c53e8fc26f983591be004ac63afd19591da079bbf67875
MassLogger
3251a40b247e2a5428a63e66306667d8fb630f56b0b6d49afd05ed72adcdd731
MassLogger
394460b6c0b33b4e5d45308e968e765627fb9f34d4ad8c51b8922543d6bf2490
MassLogger
49d9309eac532c0e556de20a5caab67bf0819266c5eee7aeb794472a3f70b3d6
MassLogger
610ed2ab81dda401cd838073f80b2d217c2a5bb8f6b35b32c6d71ed67ea4483b
MassLogger
6cb35d59850a6e43f2b6cfe1de03a41d81ab9bc07bfdb1b4b1f3cadba53d3086
MassLogger
8ea1d5e023c174a65c047ecf0f633ef66ba5adfd58ff0cc09ad084fd31f84278
MassLogger
985aeed489ef3a3af3b21b0adb1bc8a4e7d444522b742bfedee03da6879b7fc8
MassLogger
a8883460eb4eda4b981767c15ae6fadf5dd2c5ff7d8d8325b417bbdf71dece1a
MassLogger
cc8bb8e2defc7e7a4b14f479a4ce5a3fe7140c5165b789809cc89dfe7d34645c
MassLogger
+ 532 additional samples on MalwareBazaar
Result
Malware family:
masslogger
Create hunting rule
Score:
  10/10
Tags:
family:masslogger persistence spyware stealer
Link:
https://tria.ge/reports/201118-fwatkwg6b2/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious behavior: AddClipboardFormatListener
Suspicious use of SetWindowsHookEx
Suspicious use of SetThreadContext
Adds Run key to start application
Looks up external IP address via web service
Checks computer location settings
Reads user/profile data of web browsers
MassLogger
MassLogger Main Payload
Unpacked files
SH256 hash:
3cb1955eec13265edab82971675922208f0ef9d05ee1107bc321be2eb6633ef2
MD5 hash:
d54d01d0a3a073d1d2a3b70e0d9852cc
SHA1 hash:
247a757e0a66ed2b6fe263d2e87231f45de89431
Link:
https://www.unpac.me/results/1a70cd0c-dc7a-4785-a89a-b46ee57a12a6/
SH256 hash:
efc52de41a472596f9b39e2601d3e4151ee196702197c47987ec26a6811e1ee7
MD5 hash:
37ee61b2659f1eb883ed2684d3205a39
SHA1 hash:
84c4c589248951c593f8887f9261cd8d8eb4f471
Detections:
win_masslogger_w0
Create hunting rule
Link:
https://www.unpac.me/results/1a70cd0c-dc7a-4785-a89a-b46ee57a12a6/
Parent samples :
a8883460eb4eda4b981767c15ae6fadf5dd2c5ff7d8d8325b417bbdf71dece1a
3cb1955eec13265edab82971675922208f0ef9d05ee1107bc321be2eb6633ef2
SH256 hash:
83c08f0721c8b0c96e3d6a8f3ccaf5c96fbcc427d574625c34424c3429fefaa1
MD5 hash:
3c5dbcc3bb27e913e14efd8054811373
SHA1 hash:
b0eba9388abddaef9d5aa49ccd5dbab2924cced0
Link:
https://www.unpac.me/results/1a70cd0c-dc7a-4785-a89a-b46ee57a12a6/
SH256 hash:
6753a271595e6e5ec111bd8b07201dee163fc3f46120a7d91af0fbfff4675451
MD5 hash:
9618716c1e8cf624fbb6443b981c3006
SHA1 hash:
cff5f9ee7e5ae95b463deda52357b884b53051ae
Link:
https://www.unpac.me/results/1a70cd0c-dc7a-4785-a89a-b46ee57a12a6/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Keylog_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Contains Keylog
Rule name:MassLogger
Create hunting rule
Author:kevoreilly
Description:MassLogger
Rule name:masslogger_gcch
Create hunting rule
Author:govcert_ch
Rule name:Saudi_Phish_Trojan
Create hunting rule
Author:Florian Roth
Description:Detects a trojan used in Saudi Aramco Phishing
Reference:https://goo.gl/Z3JUAA
Rule name:win_masslogger_w0
Create hunting rule
Author:govcert_ch

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

MassLogger

Executable exe 3cb1955eec13265edab82971675922208f0ef9d05ee1107bc321be2eb6633ef2

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/826032/
  
Delivery method
Distributed via web download

Comments