MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4193084a6eba68bbb6aef41ffc1f21685208c6b942de9e5853b70b04834c296e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

MassLogger

Vendor detections: 9

Intelligence 9 IOCs YARA 2 File information Comments

SHA256 hash:	4193084a6eba68bbb6aef41ffc1f21685208c6b942de9e5853b70b04834c296e
SHA3-384 hash:	e5f39d6f4074277460ff30da46e2de718640357dcd165e9cbf672f1f13bb4922ccd872fdc825565956a0d8d7abda76ef
SHA1 hash:	9791d414a6db1d12a8e931e09757f873debce1ca
MD5 hash:	fdc2c2647e2bc4559501196ef4cd68e8
humanhash:	nebraska-happy-magazine-india
File name:	NEW736_SC736_PDF.exe
Download:	download sample
Signature	MassLogger Create hunting rule
File size:	1'245'696 bytes
First seen:	2020-07-22 08:42:36 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep	24576:0wrKYdedeJBEJhpdWzQVA4XV5mARa3TGOo8YVGu6wWGb:DdhKdWUA4XnRa3TGZ8Y0u6
Threatray	1'079 similar samples on MalwareBazaar
TLSH	8145CF00F7B495CEE39A4F7AD4B041009AB1E85A9BD6E34B2B90FF9D78623544B43F16
Reporter	abuse_ch
Tags:	exe MassLogger

abuse_ch

Malspam distributing MassLogger:

HELO: s51-89-27.eu-de.sugarhosts.net
Sending IP: 51.89.27.131
From: sales@comex.com.eg
Subject: Re: New Order
Attachment: NEW736_SC736_PDF.rar (contains "NEW736_SC736_PDF.exe")

MassLogger SMTP exfil server:
smtp.gmail.com:587

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

Ispy

Link:

https://www.capesandbox.com/analysis/30957/

Detection(s):

SecuriteInfo.com.MSIL.Kryptik.WYY.2739.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Unauthorized injection to a recently created process

Creating a file

Sending an HTTP GET request

Using the Windows Management Instrumentation requests

Reading Telegram data

Reading critical registry keys

Creating a file in the %temp% directory

Moving a file to the %temp% directory

Deleting a recently created file

Setting a global event handler for the keyboard

Result

Threat name:

MassLogger RAT

Detection:

malicious

Classification:

troj.spyw.evad

Score:

84 / 100

Link:

https://www.joesandbox.com/analysis/394736

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/4193084a6eba68bbb6aef41ffc1f21685208c6b942de9e5853b70b04834c296e/

Threat name:

ByteCode-MSIL.Infostealer.Fareit

Status:

Malicious

First seen:

2020-07-22 08:44:07 UTC

AV detection:

33 of 46 (71.74%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=igjqqstoxjulxnvo6qp7yhzbnbjarrvzilpj4wctw4fqja2mffxa._file

Verdict:

malicious

MassLogger

23fb5bf57b70184335261dec8c9bd0976ef8c61d843486ffdc5692aa9618e58e

MassLogger

380e7e3441bb952722dded5a8d87c79257ed78dff7d6f9bcab307428b4200578

MassLogger

66c6414f4a169a4ca29b2952c76eca04c90add82afaa5410c8f447e39481853a

MassLogger

af8343cc25fb243e378897bcf5c22ff94287610ae86538862feb362e2382b456

MassLogger

cb72b73a404d3558ab932a260d7417ca25f4f35327a9407b446ad370ff9a5e1e

MassLogger

cfdbaad170a7847c77fedbe9535a37a6d1107259c8e80f2c7e04a6b2895e86e9

MassLogger

d7f94abc222e9d72d3878ee97d3c257878e724bdb83e0ea9e92fc202d992be41

MassLogger

e51adcf99928f26014b6993369a60a9d4371759f23ddbd4d0df10105ce6de848

MassLogger

eed899d24d21a18eedea77f8f2860b70aa843e3f3757e8c53105f6eadd655d41

MassLogger

+ 1'069 additional samples on MalwareBazaar

Result

Malware family:

masslogger

Score:

10/10

Tags:

ransomware spyware stealer family:masslogger

Link:

https://tria.ge/reports/200722-cmtxp5xrxs/

Behaviour

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

Suspicious behavior: AddClipboardFormatListener

Suspicious use of SetThreadContext

Looks up external IP address via web service

Reads user/profile data of web browsers

MassLogger log file

MassLogger

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Unknown

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/4193084a6eba68bbb6aef41ffc1f21685208c6b942de9e5853b70b04834c296e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.