MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7d3633f4d63dd8e95075561828126a43b45cd0687c7e9fd58a8e556c311f5519. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

MassLogger

Vendor detections: 8

Intelligence 8 IOCs YARA 1 File information Comments

SHA256 hash:	7d3633f4d63dd8e95075561828126a43b45cd0687c7e9fd58a8e556c311f5519
SHA3-384 hash:	8e5ad9d276e159f291855cf3d542814c4f82064314402a942006d20dab73022dbe4212bb600cb6d0aa148c6a146b0ee3
SHA1 hash:	7863662d125748d06ffe1fea081dda8062eac20b
MD5 hash:	67cc54f41ccc35667904732e6dda5122
humanhash:	green-leopard-blue-hotel
File name:	Fv5vXAmPFeD4DLl.exe
Download:	download sample
Signature	MassLogger Create hunting rule
File size:	1'544'192 bytes
First seen:	2020-07-17 05:28:37 UTC
Last seen:	2020-07-17 06:02:21 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep	24576:4rvxguwcLjriV8C02QpT0fZ/3UCsuAaz541RVxKJFY1qtUEJbna:sx1LmcTMZ/3WaYxUUEJ
Threatray	728 similar samples on MalwareBazaar
TLSH	C265AFF79A4D95C2C89F9EBCC4824B710997EDC1F0F5A60B02667C363672BA0D8C546B
Reporter	JAMESWT_WT
Tags:	MassLogger

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

Ispy

Link:

https://www.capesandbox.com/analysis/27198/

Detection(s):

SecuriteInfo.com.Fareit-FXH67CC54F41CCC.13061.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Result

Threat name:

MassLogger RAT

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/388930

Signature

Found malware configuration

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

May check the online IP address of the machine

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sigma detected: Scheduled temp file as task from temp location

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to steal Mail credentials (via file access)

Uses schtasks.exe or at.exe to add and modify task schedules

Yara detected MassLogger RAT

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/7d3633f4d63dd8e95075561828126a43b45cd0687c7e9fd58a8e556c311f5519/

Threat name:

ByteCode-MSIL.Trojan.Kryptik

Status:

Malicious

First seen:

2020-07-17 05:30:08 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

24 of 29 (82.76%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=pu3dh5gwhxmosudvkymcqetkio2fzudipr7j7vmkrzkwymi7kumq._file

Verdict:

unknown

MassLogger

540a1ab8a63b1b07ea3d80939868a94dafb79f6e2fc37a8a2cc22ded21c60deb

MassLogger

750fad3db3f495fec07ac204f7e3717e75324ea9beed2fce1c48350015b888c5

MassLogger

8aef7422bb8ccc4560fb78875a0fb5d4644108a905febacd2b609012930e5744

MassLogger

8e4b63db4255d1428f0856d7e89ab1c147599416d8edd4e4e506d3f0420d77a4

MassLogger

bac48e9a9fad6c9afa0387fe592bb1eabd56cfbcbffef2bbc765e32de2846478

MassLogger

d5151bd37aa74ce1a5782e72bf26630f2df07f1e7cbeb42f45aa2f49645c35a8

MassLogger

dd0b44aeb504ee47ac61b86d092f14b7f3955b76c4b227458237acc4c9f55663

MassLogger

faf1dca0b043816dc1a448c778e8fc03030add15983e04a7cc39851297615c4f

MassLogger

fe7d67f2ca207d604740c8e66d22638049ca8a0c40818ad9f1d8515d6912f16d

MassLogger

+ 718 additional samples on MalwareBazaar

Result

Malware family:

masslogger

Score:

10/10

Tags:

ransomware spyware stealer family:masslogger

Link:

https://tria.ge/reports/200717-z1csfe8sae/

Behaviour

Suspicious use of SetWindowsHookEx

Suspicious behavior: AddClipboardFormatListener

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Creates scheduled task(s)

Suspicious use of SetThreadContext

Looks up external IP address via web service

Reads user/profile data of web browsers

MassLogger log file

MassLogger

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Unknown

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/7d3633f4d63dd8e95075561828126a43b45cd0687c7e9fd58a8e556c311f5519

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.