MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 4b174227ea49d30f3378e8469d9849015779d6d3da73333ad0b386411bfade20. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
MassLogger
Vendor detections: 10
| SHA256 hash: | 4b174227ea49d30f3378e8469d9849015779d6d3da73333ad0b386411bfade20 |
|---|---|
| SHA3-384 hash: | 4cac334c8149d529c988e761384c224c659ade072005ea8b17660b287cc25613d663770eeaeefe74ca0b6c08eb6ea042 |
| SHA1 hash: | 3cbfcdb8b5f7bcab7bd09125627228bee497faba |
| MD5 hash: | ff65414919a5ca429bd872a4f5ae696a |
| humanhash: | fish-oscar-minnesota-robin |
| File name: | Shipping Doc 3454.exe |
| Download: | download sample |
| Signature | MassLogger |
| File size: | 993'792 bytes |
| First seen: | 2020-10-17 06:33:54 UTC |
| Last seen: | 2020-10-17 08:03:45 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'741 x AgentTesla, 19'604 x Formbook, 12'242 x SnakeKeylogger) |
| ssdeep | 24576:DWtQPDCGmBosyPIg+SMvLATM8GyAbH7sNn9Vn1Tc1H+4ZhQt:IQPDCGmBoswIg+NMD4H7shrnpaH+c |
| Threatray | 379 similar samples on MalwareBazaar |
| TLSH | 1B25F0356759EF64E07E433BE4A4186483F9EC4AD332D62A7DE832CD66A1FE45122307 |
| Reporter |  abuse_ch |
| Tags: | exe MassLogger |
abuse_ch
Malspam distributing MassLogger:HELO: cgi.centirn.net
Sending IP: 68.183.61.5
From: Aamir Shiwani <info@centirn.net>
Subject: BL Draft
Attachment: Shipping Doc 3454.zip (contains "Shipping Doc 3454.exe")
Intelligence
File Origin
# of uploads :
2
# of downloads :
92
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Masslogger
Result
Verdict:
Malware
Maliciousness:
Behaviour
Unauthorized injection to a recently created process
Creating a file
Using the Windows Management Instrumentation requests
Launching a process
Sending a UDP request
Creating a window
Deleting of the original file
Result
Threat name:
MassLogger RAT
Detection:
malicious
Classification:
troj.evad
Score:
92 / 100
Signature
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected AntiVM_3
Yara detected Costura Assembly Loader
Yara detected MassLogger RAT
Behaviour
Behavior Graph:
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Status:
Malicious
First seen:
2020-10-16 14:06:19 UTC
AV detection:
24 of 29 (82.76%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Label(s):
masslogger
Similar samples:
+ 369 additional samples on MalwareBazaar
Result
Malware family:
masslogger
Score:
10/10
Tags:
spyware stealer family:masslogger
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Looks up external IP address via web service
Checks computer location settings
Deletes itself
Reads user/profile data of web browsers
MassLogger
MassLogger Main Payload
Unpacked files
SH256 hash:
4b174227ea49d30f3378e8469d9849015779d6d3da73333ad0b386411bfade20
MD5 hash:
ff65414919a5ca429bd872a4f5ae696a
SHA1 hash:
3cbfcdb8b5f7bcab7bd09125627228bee497faba
SH256 hash:
6c0077296db671c7d64671fc38f75db6e12a514bec907a25333434713627d3e5
MD5 hash:
f60ad9db856b088a82ca98183f52fc40
SHA1 hash:
0c7a36a0cfdb85d2e8fa2077ad4126fe8e92d2f4
SH256 hash:
8c031397e063406a2b6a6ed0d6de292bb36750fd6fe32123f011940c8b583b27
MD5 hash:
be49223d4acfed6277d12f4a419eceb2
SHA1 hash:
0ebac4503ea7cf7c79511e857e848695d3700e7c
Detections:
win_masslogger_w0
SH256 hash:
b5e9263bd3fb46b7b419faeb1079936b80cd455803dd88ce18a484fe83d8c255
MD5 hash:
cb53acb81c32e4a963e4114055b9ef1e
SHA1 hash:
4ee0bf72aa063284f8ed419554dfb806d0f8425e
SH256 hash:
bac5797bde4b2810766a40d95bcdb825ac5b395fcbadd139daa19a44a6cdc049
MD5 hash:
a92cc1f6e0a2742350dfda6726db14c0
SHA1 hash:
e5404e3ed46498deb8ad8966a774540c2b8e9c1e
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.