MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3e468281ddf4a728dc41a9a4d1443b5bedbd7614ae0f10be0fe61bb1bacf84f3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

MassLogger

Vendor detections: 4

Intelligence 4 IOCs YARA 1 File information Comments

SHA256 hash:	3e468281ddf4a728dc41a9a4d1443b5bedbd7614ae0f10be0fe61bb1bacf84f3
SHA3-384 hash:	ccb2f66f68e11201a880584a08ad18c74c7dfa6f1853f715b494dfbc4ef1fcdf5aaeb63242fce76a2b47250d13a51b30
SHA1 hash:	938c16c1c5c6c9b7282af8c9b4aca5f97250c142
MD5 hash:	bea3f1161a16a6fbc8f2fb2e7dbf0ec5
humanhash:	texas-ink-eleven-failed
File name:	SecuriteInfo.com.Trojan.GenericKD.43392898.2723.25907
Download:	download sample
Signature	MassLogger Create hunting rule
File size:	611'328 bytes
First seen:	2020-07-03 19:35:21 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep	12288:EgkZOg3imtX254oxLPj82cgNSsAjAuYcVWv:EgPgSm3oxLL82cQcAuv0
Threatray	701 similar samples on MalwareBazaar
TLSH	C2D44B0ABF858D11C1641B32C097E91053B48E5666A7E70FF8A573D229033EEDA4F9F6
Reporter	SecuriteInfoCom
Tags:	MassLogger

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Gathering data

Detection(s):

SecuriteInfo.com.Trojan.GenericKD.43392898.2723.25907.UNOFFICIAL

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/3e468281ddf4a728dc41a9a4d1443b5bedbd7614ae0f10be0fe61bb1bacf84f3/

Threat name:

ByteCode-MSIL.Trojan.BMassKeyLogger

Status:

Malicious

First seen:

2020-06-26 08:20:18 UTC

AV detection:

32 of 48 (66.67%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=hzdifao56stsrxcbvgsncrb3lpw325quvyhrbpqp4yn3dowpqtzq._file

Verdict:

unknown

MassLogger

131bfb49b5d80492ddcab3ec34448a445806e0c992c96eca65d42311539defe6

MassLogger

1342cdcc9231fdd7637c5a78b07485e5f2fb706479e0441f0b53bd1bd8228697

MassLogger

3277c38c152ed39a94dbc50b60675ba3438631243837bf30ce65c996ceab524d

MassLogger

41df7c7f04b04ac0f2eb88f099c9df36f01e11eaff1c189573f49054758d653d

MassLogger

43756195653d9b20db70b3b2700d6ece0e927da322db216d12e6eeb6af316f3f

MassLogger

7601104485381f818f5b171b8be6630c0f6b4792e14695e6146c876ff852cb3c

MassLogger

76933bfe9afdf8d266352155f09995acadcab23345fabe2518d5bf15d45c9cd4

MassLogger

922cd763d629a47261c509be5ac635d24bcd0f16e729b3e38074fd33317de616

MassLogger

e67fc599ed1bffe0e2f9c8db8d5d355db6fe0960c466cd8e8ee9d07eb8714894

MassLogger

+ 691 additional samples on MalwareBazaar

Result

Malware family:

masslogger

Score:

10/10

Tags:

ransomware spyware stealer family:masslogger

Link:

https://tria.ge/reports/200703-wmm22sx7w2/

Behaviour

Suspicious behavior: AddClipboardFormatListener

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

Looks up external IP address via web service

Reads user/profile data of web browsers

MassLogger

MassLogger log file

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.