MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7f2a8610931a1f5ff9793dcb854ca01aaa6410fb5b4dc287753c558f1b60eee1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

MassLogger

Vendor detections: 5

Intelligence 5 IOCs YARA 1 File information Comments

SHA256 hash:	7f2a8610931a1f5ff9793dcb854ca01aaa6410fb5b4dc287753c558f1b60eee1
SHA3-384 hash:	8ca1c40ba249d59a72beed6a3efa5326e419f453f324c67a5c0447703fac299a46aecfd7f3ad9509ddb74ce7b2b40826
SHA1 hash:	fcade786c16cd0af8b5699e57b54a30a7ce08f09
MD5 hash:	048b39faaf884a5eae0a72e2325a6fb0
humanhash:	artist-angel-lamp-uniform
File name:	Circulator 27643.exe
Download:	download sample
Signature	MassLogger Create hunting rule
File size:	975'872 bytes
First seen:	2020-06-10 07:05:06 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'741 x AgentTesla, 19'606 x Formbook, 12'242 x SnakeKeylogger)
ssdeep	24576:cv68+yXy99yJggfem35dQLLT3J4OgdNnK6S7l0:cv/++yHyJg+QvT3J4OgdI
Threatray	5'304 similar samples on MalwareBazaar
TLSH	8D25F189365076EFC82BDD76C9E82C249BA164B7531BD347A41305ED990EBDACF006E3
Reporter	abuse_ch
Tags:	exe MassLogger

abuse_ch

Malspam distributing MassLogger:

HELO: gki.com
Sending IP: 45.153.241.218
From: Purchase@gki.com
Subject: New Enquiry Circulator 26772
Attachment: Circulator 27643.iso (contains "Circulator 27643.exe")

MassLogger SMTP exfil server:
mail.itdone.cz:587

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Gathering data

Threat name:

ByteCode-MSIL.Trojan.Kryptik

Status:

Malicious

First seen:

2020-06-10 03:03:04 UTC

AV detection:

26 of 31 (83.87%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=p4vimeetdipv76lzhxfyktfadkvgieh3lng4fb3vhrky6g3a53qq._file

Verdict:

malicious

MassLogger

3142e234938b7d0d3bccb3faada5555b00f9e5d8fe9fc7dba7efe07ae03e4d99

MassLogger

4106d7796887912eef46c78f6f62593d12152ae114e6e67c004afcaddb4296f5

MassLogger

6a47bf03b1ffebac3ef5497af7d67aa562f3c401c3694d8551f7092f7f469313

MassLogger

98f14edea3c84946787d020e97f6b161cae2ed419e458434413626b9893c6f62

MassLogger

b2252d785f2e382426f925f27ae6cc491dec145159e23992098c1a70c87cea8f

MassLogger

cbaf28d8fb7addec023228bbdd6a5062e875070bc16452c15515792b78855000

MassLogger

d0be07347ce319cbce0fa252c4a030834dafe118c2ea50a6e05951ecf06b20da

MassLogger

f38f1e2f50b3e3efde74f70cf0fe4f264ebe5ddcb0d55cadc61776b12036ad68

MassLogger

fd1a4137fb29a94777cafedaaf9118b456f4f3aa7e6cc7de3a40e5c180776c34

MassLogger

+ 5'294 additional samples on MalwareBazaar

Result

Malware family:

masslogger

Score:

10/10

Tags:

family:masslogger ransomware rezer0 spyware stealer

Link:

https://tria.ge/reports/201109-c46ykbbdp6/

Behaviour

Creates scheduled task(s)

Modifies system certificate store

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Looks up external IP address via web service

Checks computer location settings

Reads user/profile data of web browsers

ServiceHost packer

rezer0

MassLogger

MassLogger Main Payload

MassLogger log file

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.