MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 565d56fb2be1977b8189a0d31222abb99e72d84d777b4253f63bca44ce0535d7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

MassLogger

Vendor detections: 3

Intelligence 3 IOCs YARA 1 File information Comments

SHA256 hash:	565d56fb2be1977b8189a0d31222abb99e72d84d777b4253f63bca44ce0535d7
SHA3-384 hash:	64bad827ab9d1067d9f64420ecae247769e274fa5523b2455b96de90a4bf89731f8dd4566c80d9cedb018337d9ac84ed
SHA1 hash:	e8fd33792d1ed321f8acf05c52ca79f29b60dc59
MD5 hash:	5445d45c4c5055033ab93973240c2e14
humanhash:	magnesium-happy-indigo-jig
File name:	Al-Mansoor _Quote_Order CAYAN LISTS14_PDF.exe
Download:	download sample
Signature	MassLogger Create hunting rule
File size:	957'952 bytes
First seen:	2020-05-26 11:09:17 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'612 x Formbook, 12'242 x SnakeKeylogger)
ssdeep	12288:v1mZwR9YnkOJcf0DG7xAWC9l4h+wwR8ASIKY93m2R8U5r8wrYTLq9WjjSSlCDoPh:gs1OJcrxHew+37vXNmYfTrYS2Oqt
Threatray	516 similar samples on MalwareBazaar
TLSH	1B15F09D32A076DFC95BC976DAA85C24AB61747B870BC207A41312ED9A1D79BCF100F3
Reporter	abuse_ch
Tags:	exe MassLogger

abuse_ch

Malspam distributing MassLogger:

HELO: dominicos-mail2.c.mad.interhost.com
Sending IP: 213.134.42.61
From: Rashid Ali //AL CAYAN Export Trading// <Officejb01@mail.com>
Subject: RFQ: Request for Quotation, ORDER P/O44532 1X40AL Cayan Export Trading
Attachment: Al-Mansoor _Quote_Order CAYAN LISTS14_PDF.r02 (contains "Al-Mansoor _Quote_Order CAYAN LISTS14_PDF.exe")

MassLogger SMTP exfil server:
microtelculiacan.com.mx:587

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

Win.Packed.Generic-7899865-0

Gathering data

Threat name:

ByteCode-MSIL.Trojan.Kryptik

Status:

Malicious

First seen:

2020-05-26 12:53:47 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

18 of 31 (58.06%)

Threat level:

2/5

Verdict:

malicious

MassLogger

239fca3f5df496aab1b7c7696aaa26d77174501abc9cb1c1e12a188584d745cc

MassLogger

3ab173f1c673d450f1f9640193efc87c76e64687e4c43ea0024287c875cde792

MassLogger

40eac0b9c7fb03c9f4a54a82b47534babfdcc931b5d83832f1ae2facd9fe0cc3

MassLogger

4820d3032206fe272d78d409bcd7143175c2db5afa6c07dcea462d6a96333a2f

MassLogger

5b2facc5a7a9b51aad80b259535b451e25598fd154dac6d6df0820a784b6005f

MassLogger

75bc5237d07d8fb7b954296a459e713127d381cccd5f6f53027af1c08c814903

MassLogger

92fe26c8230e536786caaa0932023f795e94d364ef3221a728d81d7ef90afd2a

MassLogger

a97835df055504850909bdb785d2bd535cc22702f418147cc3af6d4add370a59

MassLogger

e64a8bcf44c1671d77ee091bf44aa2021c71fb8349562dcbb4c7d6d1686d1611

MassLogger

+ 506 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

10/10

Tags:

coreentity rezer0

Link:

https://tria.ge/reports/201109-mg6lnsmpdj/

Behaviour

Suspicious behavior: GetForegroundWindowSpam

rezer0

CoreEntity .NET Packer

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.