MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5706101b5ffaf565a5690227f1c273b174eb2dcd3565904984a36be84eca6645. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 4


Intelligence 4 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5706101b5ffaf565a5690227f1c273b174eb2dcd3565904984a36be84eca6645
SHA3-384 hash: be2f458cdcc7b7eacedbc2457e85396b818bc0804f4416b6653508d61e92457acd9dc906e9e71cffc5df5ae0c417f2a6
SHA1 hash: 5646780e86a56c0944390329fea572fd58f7b516
MD5 hash: 9d19f77cd81399ccbf1e03ad9c88480f
humanhash: kansas-blue-winner-alaska
File name:PE 10563.exe
Download: download sample
Signature MassLogger
Create hunting rule
File size:769'536 bytes
First seen:2020-06-29 18:00:20 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'647 x AgentTesla, 19'451 x Formbook, 12'201 x SnakeKeylogger)
ssdeep 12288:XQ4+d5P6GXAKollr/NTs2g8wA2z4P0nuMJJib1d9YbGnNdsEJQDXVBrq5Ng2GWgC:Xod8Gcr1T0Zbn7JJixdNaEJKne5u259t
Threatray 2'213 similar samples on MalwareBazaar
TLSH B1F41224724D5877DAA90AFA8443A94103F55C79AC61F3E76DC9B0E824F37CE0982E77
Reporter abuse_ch
Tags:exe MassLogger


Avatar
abuse_ch
Malspam distributing MassLogger:

HELO: rujaapparels.com
Sending IP: 45.138.172.165
From: Jahir <Jahir@rujaapparels.com>
Subject: RE: Shipment
Attachment: PE 10563.r00 (contains "PE 10563.exe")

MassLogger SMTP exfil server:
us2.smtp.mailhostbox.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
74
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/16547/
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5706101b5ffaf565a5690227f1c273b174eb2dcd3565904984a36be84eca6645/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-29 17:52:09 UTC
AV detection:
24 of 31 (77.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=k4dbag277l2wljljait7dqttwf2owlongvszasmeunv6qtwkmzcq._file
Verdict:
unknown
Similar samples:
1bf9db8285719827160844a6a51292c30346c3099a4753c92177cba4e59b2404
MassLogger
1d0e8150809cb78fb1cf2cad89dc63b884ef4459e93ce4fbb4676ff705bb2679
MassLogger
404d422ffb09a4f24ad333ccdd211d0eb2ea84b650f095baadf3443fb6deb7b1
MassLogger
54bd5cfab1dd37a3b3c905c14768d9f2465e770a69dc0c057c2193c9ceeabed7
MassLogger
5ad061c24c84f2447a904efc6f615937d0764e3c717505b962e11f5320c17599
MassLogger
be6a3c4a0636cf4d05cdc8a58a42221d4e6358460d8dd7a679aebeeafe254a06
MassLogger
c8c3bc6c01dee147be04e3fbaeb5ff72fbee21e676ba04b7326738e692cec9d0
MassLogger
d9db86325cb63915a31775ab7b78f14802fa077e3aed9122f0fb03e9f39d05f2
MassLogger
ece024ccd4accbc99e106f03c4b4764765b37615e3caa0b021084ac5f689cc3e
MassLogger
f450de216509d54d57606d71016ad6749f124b789a35ceffbbc5f768d62bdf4d
MassLogger
+ 2'203 additional samples on MalwareBazaar
Result
Malware family:
masslogger
Create hunting rule
Score:
  10/10
Tags:
ransomware spyware stealer family:masslogger
Link:
https://tria.ge/reports/200629-bqzclz7hrx/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious behavior: AddClipboardFormatListener
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Creates scheduled task(s)
Suspicious use of SetThreadContext
Looks up external IP address via web service
Reads user/profile data of web browsers
MassLogger log file
MassLogger
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:masslogger_gcch
Create hunting rule
Author:govcert_ch

File information

The table below shows additional information about this malware sample such as delivery method and external references.

e936bd76fde1cde8a00ba008a4c30d7b

MassLogger

Executable exe 5706101b5ffaf565a5690227f1c273b174eb2dcd3565904984a36be84eca6645

(this sample)

  
Dropped by
MD5 e936bd76fde1cde8a00ba008a4c30d7b
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/16547/

Comments