MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 3d0af7312beff6b913ae04b6c6b3f9aac323308a1933952d1c8bd732fdf290ce. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
MassLogger
Vendor detections: 9
| SHA256 hash: | 3d0af7312beff6b913ae04b6c6b3f9aac323308a1933952d1c8bd732fdf290ce |
|---|---|
| SHA3-384 hash: | ef08e505fb6c54948f47efe8753940bfa0dcb51741b628bf913c16b2be6c09bdda204c07ebce27c7b488191c49215f3a |
| SHA1 hash: | c2dc509acef33461268ba76bafbdb11e81e3d759 |
| MD5 hash: | 81297e7d0a24d0566bf47c8bebd0a3e2 |
| humanhash: | lion-cold-six-cat |
| File name: | LP40728194004.exe |
| Download: | download sample |
| Signature | MassLogger |
| File size: | 1'318'912 bytes |
| First seen: | 2020-08-07 13:23:22 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | d2c5bb9650248d566011b3a45aa89b6f (2 x HawkEye, 2 x AgentTesla, 1 x MassLogger) |
| ssdeep | 24576:myrAsCU/TdrqBRzSwEJsYJkqwMUa4UJYnrXWZZSdOkICTv:my6e5xz4JXYZSdOSTv |
| Threatray | 1'242 similar samples on MalwareBazaar |
| TLSH | 8C55BF32B591443ED13226389F7B9EE55C267E132D28B50A2BE41C0F7F3968D35252AF |
| Reporter |  abuse_ch |
| Tags: | exe MassLogger |
abuse_ch
Malspam distributing unidentified malware:HELO: nslsugars.com
Sending IP: 185.222.57.136
From: enquiryjaymahesh@nslsugars.com
Subject: URGENT ENQUIRY
Attachment: LP40728194004.cab (contains "LP40728194004.exe")
Intelligence
File Origin
# of uploads :
1
# of downloads :
76
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Ispy
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Unauthorized injection to a recently created process
Sending a UDP request
Using the Windows Management Instrumentation requests
Running batch commands
Creating a file
Launching a process
Deleting of the original file
Result
Threat name:
MassLogger RAT
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Signature
Contains functionality to detect sleep reduction / modifications
Deletes itself after installation
Detected unpacking (changes PE section rights)
Detected unpacking (creates a PE file in dynamic memory)
Detected unpacking (overwrites its own PE header)
Maps a DLL or memory area into another process
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected AntiVM_3
Yara detected Costura Assembly Loader
Yara detected MassLogger RAT
Behaviour
Behavior Graph:
Threat name:
Win32.Backdoor.Androm
Status:
Malicious
First seen:
2020-08-07 13:25:07 UTC
AV detection:
24 of 28 (85.71%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
hawkeyekeylogger
Similar samples:
+ 1'232 additional samples on MalwareBazaar
Result
Malware family:
masslogger
Score:
10/10
Tags:
ransomware upx spyware stealer family:masslogger
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Suspicious behavior: AddClipboardFormatListener
Suspicious use of SetThreadContext
Looks up external IP address via web service
Reads user/profile data of web browsers
UPX packed file
MassLogger log file
MassLogger
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.