MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 5bcbbf82aa7c1bde8cddd6a6d50b4b082555ddb0dd23dd468ef238850238ed2a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
MassLogger
Vendor detections: 6
| SHA256 hash: | 5bcbbf82aa7c1bde8cddd6a6d50b4b082555ddb0dd23dd468ef238850238ed2a |
|---|---|
| SHA3-384 hash: | d4e1c97d5e4c4ca229faddda354fc7aeb0a3db77e2bda19a5759440383c226ec03db77f14dfd4a87bee14fa58cd4fa1c |
| SHA1 hash: | 4932392ebc7a8a56b784058c64d6325a7ef7f587 |
| MD5 hash: | 7e9981e9cb52526de52f424274cbed4c |
| humanhash: | sad-romeo-leopard-eighteen |
| File name: | Ref ____ New Tender 32-29-1441__.exe |
| Download: | download sample |
| Signature | MassLogger |
| File size: | 1'272'832 bytes |
| First seen: | 2020-08-18 08:43:25 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 639357242ed279ceaa4726408d2cc6d5 (10 x AgentTesla, 4 x Formbook, 3 x MassLogger) |
| ssdeep | 24576:3F7OuHzkK4d7403c8UnJwgnvhU1rsZWx35Rh:3Fy+f8nc8UnJr21iWN5Rh |
| Threatray | 529 similar samples on MalwareBazaar |
| TLSH | FF45BE22BDF14836D0F31A784C5F7E749829BDD139F8855B7BE84C0C9E25E403969E8A |
| Reporter |  abuse_ch |
| Tags: | exe MassLogger |
abuse_ch
Malspam distributing unidentified malware:HELO: alanwarece.com
Sending IP: 185.222.57.169
From: Ibrahim Hassan Salem <admin@alanwarece.com>
Subject: New Tender 32-29-1441 (RFQ for Supplies)
Attachment: Ref ____ New Tender order 32-29-1441.zip (contains "Ref ____ New Tender 32-29-1441__.exe")
Intelligence
File Origin
# of uploads :
1
# of downloads :
70
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Detection(s):
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Unauthorized injection to a recently created process
Sending a UDP request
Using the Windows Management Instrumentation requests
Running batch commands
Creating a file
Launching a process
Deleting of the original file
Threat name:
Win32.Infostealer.Fareit
Status:
Malicious
First seen:
2020-08-17 19:52:13 UTC
AV detection:
25 of 29 (86.21%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
hawkeyekeylogger
Similar samples:
+ 519 additional samples on MalwareBazaar
Result
Malware family:
masslogger
Score:
10/10
Tags:
ransomware upx spyware stealer family:masslogger
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Looks up external IP address via web service
Reads user/profile data of web browsers
UPX packed file
MassLogger
MassLogger log file
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.