MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 51d9993db6088b6817645cc0054e62926e4f249cb405ae05355a6d4520a46525. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

MassLogger

Vendor detections: 4

Intelligence 4 IOCs YARA 1 File information Comments

SHA256 hash:	51d9993db6088b6817645cc0054e62926e4f249cb405ae05355a6d4520a46525
SHA3-384 hash:	7573172aeb0ed389eabdd7fb204d6b0cc1e2e8142cbd41ec2048ca919cb0c04a0465db800422cfde6f31d21d262ef531
SHA1 hash:	e23ea5b6598855dd7959829a4ab35d766d1f843c
MD5 hash:	4171abbcb366d00815bc70c1c794a703
humanhash:	kilo-glucose-march-march
File name:	Detalhes da conta bancÃ¡ria.exe
Download:	download sample
Signature	MassLogger Create hunting rule
File size:	1'014'272 bytes
First seen:	2020-07-13 11:07:26 UTC
Last seen:	2020-07-13 12:01:39 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'658 x AgentTesla, 19'469 x Formbook, 12'208 x SnakeKeylogger)
ssdeep	24576:E0RY/THe6bp7SmDSqEmz6715pvTphSp9pMMEfba8:zMHbb9DDSC63h1hSpwha
Threatray	900 similar samples on MalwareBazaar
TLSH	4425014735988F82C53907F9A8FB0430D7F4689B0933E685AEE7D5E91D117CA1A1E28F
Reporter	abuse_ch
Tags:	exe MassLogger

abuse_ch

Malspam distributing MassLogger:

HELO: server.welltechcables.com
Sending IP: 89.223.125.116
From: Cheryl Burns<info@welltechcables.com>
Subject: Forma de pagamento
Attachment: Detalhes da conta bancria.7z (contains "Detalhes da conta bancÃ¡ria.exe")

MassLogger SMTP exfil server:
mail.mytravelexplorer.com:587

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Gathering data

Detection(s):

SecuriteInfo.com.MSIL.Kryptik.WTN.22652.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

Creating a window

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/51d9993db6088b6817645cc0054e62926e4f249cb405ae05355a6d4520a46525/

Threat name:

ByteCode-MSIL.Trojan.Kryptik

Status:

Malicious

First seen:

2020-07-13 11:09:07 UTC

AV detection:

22 of 29 (75.86%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=khmzspnwbcfwqf3eltaakttcsjxe6je4wqc24bjvljwukifemusq._file

Verdict:

suspicious

MassLogger

2e38449ec685638089e3863a2c03ba15c8b18b16f9e75ec869a4b87c34aabd28

MassLogger

45808d9b0a58982e3bddb4e711f25d5224ad78165fbeb24b1a720358679bcbc3

MassLogger

48cad358250f70cffecaed785f4d128f48174adc0ee5948e00ab1b6ffbef803c

MassLogger

49ebdee0fec93cc0c1815c018bdff160a61568e5e1369336918a97724dd4ad72

MassLogger

6f00ffaa9b0fe22f4e8e46fc35998010ecabecac8ffbdc4629e1b59372393a6b

MassLogger

732ab979547134cb8b3145f6d3850a73af1b19201cca8a4bc4d4b5c09198646e

MassLogger

7cee0e7a663f8a865255723ea5fe89fac90be773094c04ad82b5aee132f50cd7

MassLogger

cd84429e1881bd2029dc69963d9fd46049b11c50e2af7b8aae34ec877dda42e9

MassLogger

f66a9d139aac9008f3ca07794f8389eed945e1391b0ec20c72534a51bda3bea2

MassLogger

+ 890 additional samples on MalwareBazaar

Result

Malware family:

masslogger

Score:

10/10

Tags:

ransomware spyware stealer family:masslogger

Link:

https://tria.ge/reports/200713-gnvcxsxp5a/

Behaviour

Creates scheduled task(s)

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

Suspicious behavior: AddClipboardFormatListener

Suspicious use of SetThreadContext

Looks up external IP address via web service

Reads user/profile data of web browsers

MassLogger log file

MassLogger

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.