MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 45218cff19288368cd0f20a83063822a27839fec0624c10df26f19346e7c41d5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 9


Intelligence 9 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 45218cff19288368cd0f20a83063822a27839fec0624c10df26f19346e7c41d5
SHA3-384 hash: 1e566b6bcf95de7d7fb4b2dcb9b42305d50d253ac15f6e8b98a8c7eb649483a9fb9a99d7f20fb70521878fc400153d25
SHA1 hash: 3dc225d793be027d0e1a5f6f3eb94f96b2b7dc36
MD5 hash: 5d181e9794664f9d51852f528614a6d3
humanhash: sodium-pluto-echo-early
File name:RFQ.PDF.exe
Download: download sample
Signature MassLogger
Create hunting rule
File size:712'192 bytes
First seen:2020-10-15 11:22:59 UTC
Last seen:2020-10-15 12:15:56 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash c458ff2d515beb8f44158cd3636a7400 (19 x AgentTesla, 6 x NetWire, 3 x HawkEye)
ssdeep 12288:pY5A+yK4n+EiQmzuFLttbp8icHKKfDFKiBY66IzajzF89kfrttIuOBdLm:pcbhO3miZtVp8ic9D1BEIK8WJdO2
Threatray 126 similar samples on MalwareBazaar
TLSH 4BE4235A69766B76E1A93AF1A95EBEFE788CB5905D3CDB203C19C8F4503A0D5CF01302
Reporter abuse_ch
Tags:exe MassLogger

Intelligence

File Origin
# of uploads :
2
# of downloads :
83
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Detection(s):
PUA.Win.Packer.Upx-49
Create hunting rule

PUA.Win.Packer.UpxProtector-1
Create hunting rule

PUA.Win.Packer.Upolyx-12
Create hunting rule

PUA.Win.Packer.Upx-4
Create hunting rule

PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a window
Unauthorized injection to a recently created process
Using the Windows Management Instrumentation requests
Creating a file
Launching a process
Deleting of the original file
Result
Threat name:
MassLogger RAT
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/492199
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code references suspicious native API functions
Antivirus / Scanner detection for submitted sample
Contains functionality to detect sleep reduction / modifications
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for submitted file
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sigma detected: Suspicious Double Extension
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses an obfuscated file name to hide its real file extension (double extension)
Yara detected Costura Assembly Loader
Yara detected MassLogger RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 298550 Sample: RFQ.PDF.exe Startdate: 15/10/2020 Architecture: WINDOWS Score: 100 66 Malicious sample detected (through community Yara rule) 2->66 68 Antivirus / Scanner detection for submitted sample 2->68 70 Multi AV Scanner detection for submitted file 2->70 72 9 other signatures 2->72 14 RFQ.PDF.exe 2->14         started        process3 signatures4 80 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 14->80 82 Maps a DLL or memory area into another process 14->82 84 Contains functionality to detect sleep reduction / modifications 14->84 17 RFQ.PDF.exe 14->17         started        19 RFQ.PDF.exe 3 14->19         started        process5 file6 22 RFQ.PDF.exe 17->22         started        62 C:\Users\user\AppData\...\RFQ.PDF.exe.log, ASCII 19->62 dropped 25 powershell.exe 19 19->25         started        process7 signatures8 74 Maps a DLL or memory area into another process 22->74 27 RFQ.PDF.exe 22->27         started        29 RFQ.PDF.exe 2 22->29         started        31 conhost.exe 25->31         started        process9 process10 33 RFQ.PDF.exe 27->33         started        36 powershell.exe 18 29->36         started        signatures11 64 Maps a DLL or memory area into another process 33->64 38 RFQ.PDF.exe 33->38         started        40 RFQ.PDF.exe 33->40         started        42 conhost.exe 36->42         started        process12 process13 44 RFQ.PDF.exe 38->44         started        47 powershell.exe 40->47         started        signatures14 78 Maps a DLL or memory area into another process 44->78 49 RFQ.PDF.exe 44->49         started        51 RFQ.PDF.exe 44->51         started        53 conhost.exe 47->53         started        process15 process16 55 RFQ.PDF.exe 49->55         started        58 powershell.exe 51->58         started        signatures17 76 Maps a DLL or memory area into another process 55->76 60 conhost.exe 58->60         started        process18
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/45218cff19288368cd0f20a83063822a27839fec0624c10df26f19346e7c41d5/
Threat name:
Win32.Trojan.Ymacco
Create hunting rule
Status:
Malicious
First seen:
2020-10-15 08:35:34 UTC
AV detection:
25 of 29 (86.21%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=iuqyz7yzfcbwrtipecuday4cfityhh7maysmcdpsn4mti3t4ihkq._file
Verdict:
malicious
Label(s):
masslogger
Create hunting rule
Similar samples:
0cb22d3d57812fd7f79b93f77efe33302e171b29f540f3883239f31228966a17
MassLogger
1d3286d29155618ebaf43cfebc809f80daa7d247b9e3c872ea5c48c8109afcd0
MassLogger
1e3f14f932364db4904b69fce12e373e6354f4291dcda0d82a8477a21a9a803f
MassLogger
2fea8f7c727460dfd943dce7f9bb051f188f37a0150a132039a1892f18749ff3
MassLogger
730a42a6d12942f236eefda66452c790e1f506ed57437342e3e0bdda9bf84143
MassLogger
74162983ed626c05ba65a31fa71a81ff2bc4cabcfe5019a94f63dc32ae873f23
MassLogger
8b57afe96667b88596d51dabfee3359371f517cf97a758473eae0f9d2aa97db9
MassLogger
8f24b4adb843172c14b392bcf73f1f46ac8a20091cb22649110bb937f84b281c
MassLogger
9f0866780aa84107697212f1b3578777c450861c02a6e01f5741de28c858900c
MassLogger
a2b0e9c1ea03a3a538fe9ef7f8e6dbf4c08feba8560e238e29fce0dd2f2e144b
MassLogger
+ 116 additional samples on MalwareBazaar
Result
Malware family:
masslogger
Create hunting rule
Score:
  10/10
Tags:
upx spyware stealer family:masslogger
Link:
https://tria.ge/reports/201015-f5tfsxaccn/
Behaviour
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Looks up external IP address via web service
Checks computer location settings
Reads user/profile data of web browsers
UPX packed file
MassLogger
MassLogger Main Payload
Unpacked files
SH256 hash:
45218cff19288368cd0f20a83063822a27839fec0624c10df26f19346e7c41d5
MD5 hash:
5d181e9794664f9d51852f528614a6d3
SHA1 hash:
3dc225d793be027d0e1a5f6f3eb94f96b2b7dc36
Link:
https://www.unpac.me/results/8c2678dc-47fa-4ead-9c84-21ef3dcad4de/
SH256 hash:
22279c16b92137f2e88185bbfaaec7c311cb9cc310cd45bcf3478cbf755134b5
MD5 hash:
731da7f93ae19485c69c236fc44ead69
SHA1 hash:
3ac07e7b30b5c4d044988e89d86a76031aa432c9
Link:
https://www.unpac.me/results/8c2678dc-47fa-4ead-9c84-21ef3dcad4de/
SH256 hash:
84aacd2209019cbfc7e14dbf4c050f5cb445c8291291ceead67f9396cef3c183
MD5 hash:
b31d8074f8cdc0eb9a0a2902acf4cbeb
SHA1 hash:
3c47ecfdda790c73be7083739065af8310b7ceba
Detections:
win_masslogger_w0
Create hunting rule
Link:
https://www.unpac.me/results/8c2678dc-47fa-4ead-9c84-21ef3dcad4de/
SH256 hash:
6c6dc0ca4e1473b6a3dfd08392db08fdd8e1bbe22e7c01c3404540482fc023ca
MD5 hash:
421a5274971334f57e45bb278f4f6826
SHA1 hash:
4cc6b5de15688a008d198dd51f5c810a2837a6c9
Detections:
win_masslogger_w0
Create hunting rule
Link:
https://www.unpac.me/results/8c2678dc-47fa-4ead-9c84-21ef3dcad4de/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/45218cff19288368cd0f20a83063822a27839fec0624c10df26f19346e7c41d5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:suspicious_packer_section
Create hunting rule
Author:@j0sm1
Description:The packer/protector section names/keywords
Reference:http://www.hexacorn.com/blog/2012/10/14/random-stats-from-1-2m-samples-pe-section-names/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

Executable exe 45218cff19288368cd0f20a83063822a27839fec0624c10df26f19346e7c41d5

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/71280/

Comments