MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 546274026ba4ffdc8c226e6fbbb52e9afd9a3b79544bc08aeb372f505b7e98f9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
MassLogger
Vendor detections: 8
| SHA256 hash: | 546274026ba4ffdc8c226e6fbbb52e9afd9a3b79544bc08aeb372f505b7e98f9 |
|---|---|
| SHA3-384 hash: | 102bd77c6b7ebd363156273197975b9e7a2f52d703ce48c4d36ae1874dcc077cee3d9c19be3444f670b519367a2ac4cc |
| SHA1 hash: | 106e8a77bd539af2957cef9de58c8ac2d9fda4a4 |
| MD5 hash: | b3fbf58f039b6c79bf5c6e6a05f2c326 |
| humanhash: | paris-beryllium-kentucky-uniform |
| File name: | b3fbf58f039b6c79bf5c6e6a05f2c326.exe |
| Download: | download sample |
| Signature | MassLogger |
| File size: | 461'312 bytes |
| First seen: | 2020-11-01 07:22:23 UTC |
| Last seen: | 2020-11-01 08:47:59 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'663 x AgentTesla, 19'478 x Formbook, 12'208 x SnakeKeylogger) |
| ssdeep | 12288:qPw1hbgXKyaZCd3hSAnvyYHG0ppjOp7BWC/oHC:qPw306O3jn9GEOb4H |
| Threatray | 571 similar samples on MalwareBazaar |
| TLSH | 59A4E0AC761079EFC817C932CA651D64E76074BB431BD203A4A326ED9A4DA9BCF504F3 |
| Reporter |  abuse_ch |
| Tags: | exe MassLogger |
Intelligence
File Origin
# of uploads :
2
# of downloads :
148
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Result
Verdict:
Malware
Maliciousness:
Behaviour
Sending a UDP request
Creating a file in the %AppData% subdirectories
DNS request
Sending an HTTP GET request
Using the Windows Management Instrumentation requests
Creating a window
Creating a file
Reading critical registry keys
Moving a recently created file
Deleting a recently created file
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Setting a global event handler for the keyboard
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
MassLogger RAT
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Found malware configuration
Machine Learning detection for dropped file
Machine Learning detection for sample
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file access)
Yara detected AntiVM_3
Yara detected Costura Assembly Loader
Yara detected MassLogger RAT
Behaviour
Behavior Graph:
Threat name:
ByteCode-MSIL.Trojan.Malrep
Status:
Malicious
First seen:
2020-10-29 15:09:32 UTC
AV detection:
21 of 29 (72.41%)
Threat level:
5/5
Verdict:
suspicious
Similar samples:
+ 561 additional samples on MalwareBazaar
Result
Malware family:
masslogger
Score:
10/10
Tags:
family:masslogger persistence ransomware spyware stealer
Behaviour
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Adds Run key to start application
Looks up external IP address via web service
Checks computer location settings
Reads user/profile data of web browsers
MassLogger
MassLogger Main Payload
MassLogger log file
Unpacked files
SH256 hash:
84ecbad107cfa8012799c66f98d0e20fb3b8fb269d8c5c198a0f76f25e2c7902
MD5 hash:
84727a5600fc38bca121e62b110d9486
SHA1 hash:
2ec9155061e3185bf397276d146704d9f852adac
SH256 hash:
546274026ba4ffdc8c226e6fbbb52e9afd9a3b79544bc08aeb372f505b7e98f9
MD5 hash:
b3fbf58f039b6c79bf5c6e6a05f2c326
SHA1 hash:
106e8a77bd539af2957cef9de58c8ac2d9fda4a4
SH256 hash:
faeccba6322c17450fc1dd8614d266f1c2dfa5adfe463b8833c726974420694b
MD5 hash:
385c3f0ff7141a51959b41f45bb361a7
SHA1 hash:
3ff4a5a79346cb83a60582a2266993d6f1982108
SH256 hash:
a4009288982e4c30d22b544167f72db882e34f0fda7d4061b2c02c84688c0ed1
MD5 hash:
7c359500407dd393a276010ab778d5af
SHA1 hash:
4d63d669b73acaca3fc62ec263589acaaea91c0b
SH256 hash:
243fc264f777e801fcb6a90c2543855877603e104e2e6e807faa097c0b918fed
MD5 hash:
6ef2a650186527f78aab0fab01ea5323
SHA1 hash:
802044443f5a9b26be068464edef210dadb1465d
Detections:
win_masslogger_w0
Parent samples :
4d6b9805be6686ee8a01a91f2e8b949b0aeebd7dcd4ef555cd84e0eb8accc678
7a4a073fb5cee4010e0c4a19d8dd6cdd65850b64c681410d5fb17751710cccaa
96cc9904f92eba3b9c8e2f90b7096e5174df7eed983bf1f6e43e855dea170003
ba18dbaa37dfcb07d8dc014a9801196e419dd2f6936a4fcd1826d4c55a938bea
546274026ba4ffdc8c226e6fbbb52e9afd9a3b79544bc08aeb372f505b7e98f9
7a4a073fb5cee4010e0c4a19d8dd6cdd65850b64c681410d5fb17751710cccaa
96cc9904f92eba3b9c8e2f90b7096e5174df7eed983bf1f6e43e855dea170003
ba18dbaa37dfcb07d8dc014a9801196e419dd2f6936a4fcd1826d4c55a938bea
546274026ba4ffdc8c226e6fbbb52e9afd9a3b79544bc08aeb372f505b7e98f9
SH256 hash:
6efe5e4573145074beaeee5c91b632f2e3869a93b7cd5b539cdde9eb6deddc7c
MD5 hash:
e68e31407aaed366a697dec98fcd00ea
SHA1 hash:
aa40eabce85ba2aa78a13aafdc0983f8ff03b4ad
SH256 hash:
91d01634d2d10d60d6dbffd79ced7590863446e38af7fdf33be41809a51fd937
MD5 hash:
ea7c4fbb1305d921ed9d6c2e309cf389
SHA1 hash:
d232acd34af0c0114981cea401f07974567c390d
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.