MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 750fad3db3f495fec07ac204f7e3717e75324ea9beed2fce1c48350015b888c5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

MassLogger

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	750fad3db3f495fec07ac204f7e3717e75324ea9beed2fce1c48350015b888c5
SHA3-384 hash:	98282cb98426b20bfd6e80b30bfc257f26556c06d81835ddee44e10ba0137cd88f53ead0c17716d15051a8d50d96963b
SHA1 hash:	4a5189e76f1e4ea370f53f884dad58f4630168a2
MD5 hash:	29dca360241427d5bc482839827d271b
humanhash:	single-island-batman-maine
File name:	06463NWRL6xAdIh.exe
Download:	download sample
Signature	MassLogger Create hunting rule
File size:	1'320'960 bytes
First seen:	2020-07-17 05:26:58 UTC
Last seen:	2020-07-17 06:46:38 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'461 x Formbook, 12'202 x SnakeKeylogger)
ssdeep	24576:LrvxguwcLjrHeq5YWCLVIojbU1yMYs9JgBqehB2:Px1LfJC6oayMYsj7ehB2
Threatray	722 similar samples on MalwareBazaar
TLSH	2A558DF39A4DC1D2C8AF9EBDC9824B700987ED81F0F5A60B12567C3637767A0D88516B
Reporter	JAMESWT_WT
Tags:	MassLogger

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/27190/

Detection(s):

SecuriteInfo.com.Fareit-FXH29DCA3602414.32653.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Launching a process

Creating a process with a hidden window

Result

Threat name:

MassLogger RAT

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/388914

Signature

Found malware configuration

Machine Learning detection for dropped file

Machine Learning detection for sample

May check the online IP address of the machine

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sigma detected: Scheduled temp file as task from temp location

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file access)

Uses schtasks.exe or at.exe to add and modify task schedules

Yara detected MassLogger RAT

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/750fad3db3f495fec07ac204f7e3717e75324ea9beed2fce1c48350015b888c5/

Threat name:

ByteCode-MSIL.Trojan.Kryptik

Status:

Malicious

First seen:

2020-07-17 05:28:07 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

23 of 29 (79.31%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=ouh22pnt6sk75qd2yicppy3rpz2tetvjx3ws7tq4ja2qafnyrdcq._file

Verdict:

unknown

MassLogger

540a1ab8a63b1b07ea3d80939868a94dafb79f6e2fc37a8a2cc22ded21c60deb

MassLogger

7d3633f4d63dd8e95075561828126a43b45cd0687c7e9fd58a8e556c311f5519

MassLogger

8aef7422bb8ccc4560fb78875a0fb5d4644108a905febacd2b609012930e5744

MassLogger

8e4b63db4255d1428f0856d7e89ab1c147599416d8edd4e4e506d3f0420d77a4

MassLogger

bac48e9a9fad6c9afa0387fe592bb1eabd56cfbcbffef2bbc765e32de2846478

MassLogger

d5151bd37aa74ce1a5782e72bf26630f2df07f1e7cbeb42f45aa2f49645c35a8

MassLogger

dd0b44aeb504ee47ac61b86d092f14b7f3955b76c4b227458237acc4c9f55663

MassLogger

faf1dca0b043816dc1a448c778e8fc03030add15983e04a7cc39851297615c4f

MassLogger

fe7d67f2ca207d604740c8e66d22638049ca8a0c40818ad9f1d8515d6912f16d

MassLogger

+ 712 additional samples on MalwareBazaar

Result

Malware family:

masslogger

Score:

10/10

Tags:

ransomware spyware stealer family:masslogger

Link:

https://tria.ge/reports/200717-csndhw7lsx/

Behaviour

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

Suspicious behavior: AddClipboardFormatListener

Creates scheduled task(s)

Suspicious use of SetThreadContext

Looks up external IP address via web service

Reads user/profile data of web browsers

MassLogger

MassLogger log file

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Unknown

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/750fad3db3f495fec07ac204f7e3717e75324ea9beed2fce1c48350015b888c5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.