MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 49ced6e317fa96af1310ad10e5b71fea0d84e03b42ff0434f11d312ebb62dbcf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

MassLogger

Vendor detections: 5

Intelligence 5 IOCs YARA 1 File information Comments

SHA256 hash:	49ced6e317fa96af1310ad10e5b71fea0d84e03b42ff0434f11d312ebb62dbcf
SHA3-384 hash:	5bb833e7ac03bb746d998352ac512411211ff35c397045a0b6a25f662c437bb84ce238dee6e11c435f7819e0d0a46bce
SHA1 hash:	fd4c476494adc0e34ef04183042744251d62e2eb
MD5 hash:	edd5bb0a52718d2cdb4eee1fbfdb33dc
humanhash:	iowa-bluebird-three-emma
File name:	INVOICE RD-65_xls.exe
Download:	download sample
Signature	MassLogger Create hunting rule
File size:	856'576 bytes
First seen:	2020-06-17 05:45:09 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'461 x Formbook, 12'202 x SnakeKeylogger)
ssdeep	12288:IgjVMk4JOf7teSVEWUNGZESjMx5e9abLwCnHyP7DELV1bBfO0ee+WJ7nOoG24dKe:Ig29JwHVE1NldbLwCn91tfOzqG24Q5u
Threatray	537 similar samples on MalwareBazaar
TLSH	E405130976E8A611C5751A3EE8EB403413FB9DA22963F65FBEC8334E55423E21A053DF
Reporter	abuse_ch
Tags:	exe MassLogger

abuse_ch

Malspam distributing MassLogger:

HELO: mail.carryboy.com
Sending IP: 27.254.141.68
From: Habib <prasong@carryboy.com>
Subject: FW: 50% TT payment from RD International
Attachment: INVOICE RD-65_xls.rar (contains "INVOICE RD-65_xls.exe")

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Gathering data

Detection(s):

SecuriteInfo.com.BehavesLike.Generic.fc.30295.UNOFFICIAL

Gathering data

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2020-06-17 05:47:05 UTC

AV detection:

24 of 31 (77.42%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=jhhnnyyx7klk6eyqvuiolny75igyjyb3il7qinhrduys5o3c3phq._file

Verdict:

malicious

MassLogger

8a3dd3eb355760a77c7bd89e2316c7741e37f9b20435a23d144e58ba856bd7c7

MassLogger

8bc95f1ba65bf54858a20c62bf09e9e39027f8be74369c25401b5e4503b1b553

MassLogger

8fd65d51cacf70ad39a95d0c7e89af58c406bce0a61f1365ba7889475e0e1218

MassLogger

a2a4fc12990dcf4a9778f96840b49be84f9563edd2b5209b6dac1ffb2ed8e38d

MassLogger

a760f527a357c0102eb9d9ecc6ca76f245d34237b230ce9a38e83ae806ab13cb

MassLogger

c16e569fe7d77436566b268fab7037ab71efb99a5108aa452602479267508305

MassLogger

cac67b5ab04de81f69b8f4f882ad22e26672a61ed96d2e1f69d72f59c36bf401

MassLogger

dc6eb4d716d3a1c045090d38abe87f80e14ab2bbb997268a2190332fb7563dcb

MassLogger

f937bbe27c6d52452a121bc9aa320c26ae7eada7cadc9dda0fafc2c6b1bd5818

MassLogger

+ 527 additional samples on MalwareBazaar

Result

Malware family:

masslogger

Score:

10/10

Tags:

ransomware spyware stealer family:masslogger

Link:

https://tria.ge/reports/200624-edlf1gtnrx/

Behaviour

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: AddClipboardFormatListener

Suspicious use of SetWindowsHookEx

Suspicious use of SetThreadContext

Looks up external IP address via web service

Reads user/profile data of web browsers

MassLogger log file

MassLogger

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.