MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7fcccc36958bd79308c0a9a1bbb9cf89d025b256dbee80dc9fc2e52f776573d7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


M00nD3v


Vendor detections: 4


Intelligence 4 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7fcccc36958bd79308c0a9a1bbb9cf89d025b256dbee80dc9fc2e52f776573d7
SHA3-384 hash: f656a3632d5f2dc2763f8a9380bbc67cf0119a19412c68f13d31d26e80e1241bd0a0820aa00d4e6b05a704d9dcc96f3f
SHA1 hash: ee12ad7c217408c66e86941cef5d83c6ed5f023e
MD5 hash: 7e407218e927fb38cf63ba4799351723
humanhash: beer-mars-leopard-carolina
File name:7e407218e927fb38cf63ba4799351723.exe
Download: download sample
Signature M00nD3v
Create hunting rule
File size:357'888 bytes
First seen:2020-05-25 13:50:24 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 6144:fWk8ABCz0D/vW8/le/Gqj1gSC/w4mfNg/P8Lf1KZUOC5HusGqA:+k8ABCgDG8/l0Gi1geRfN/fHus+
Threatray 511 similar samples on MalwareBazaar
TLSH 4774123AA3D82D2BC36C58F9F490424423BD97EA8753F34E0D4CA4E6BD93794465A933
Reporter abuse_ch
Tags:exe M00nD3v

Intelligence

File Origin
# of uploads :
1
# of downloads :
76
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-25 14:24:17 UTC
File Type:
PE (.Net Exe)
Extracted files:
7
AV detection:
25 of 31 (80.65%)
Threat level:
  2/5
Verdict:
malicious
Label(s):
hawkeyekeylogger
Create hunting rule
emotet
Create hunting rule
Similar samples:
2176a0e2b600d06c89a8ebeeea19444df5a5ede09639af04f88d734b7fe01633
M00nD3v
24ba43e08e645a71b01db7cd77883fd1aa4c21e834f45c4f690768ed28c23552
M00nD3v
4d1fc12e362e8f90ad1407c54575e3c39f3fd8cacde48007ecf46baa9ba1473d
M00nD3v
642ce48af8f6fb3c7a74225655ef59a92e7cd4fcb98dc4af02359fb3490a9c55
M00nD3v
6cacb53730640ce58bbb9c5bc6c6d39b5ea9c7a0d21eec9ce131f82c0e159361
M00nD3v
89c3a9a4a75c80b3552df2a5bda935056bc3a55a6f76b264645593cb966e2b74
M00nD3v
b3088a313a00c6774cb853379f427ffaab01a528a4561f814e2c7af24e5bfba2
M00nD3v
c4a2c8397cfa4f7f16a317aad541b6c48e35c4420249f702b2c6f01faf66ef61
M00nD3v
d64c548cdf246a19722734b1c94f30252f00873a2e0960dccd05101f05e845d9
M00nD3v
e836f76c716c021e89d19ee4e4456e04b04b1041fe04fdaa6ac7523d35ef3b60
M00nD3v
+ 501 additional samples on MalwareBazaar
Result
Malware family:
m00nd3v_logger
Create hunting rule
Score:
  10/10
Tags:
family:m00nd3v_logger coreentity rezer0 spyware stealer
Link:
https://tria.ge/reports/201109-zx3ndqxjqe/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Looks up external IP address via web service
Reads user/profile data of web browsers
Uses the VBS compiler for execution
M00nD3v Logger Payload
rezer0
M00nd3v_Logger
CoreEntity .NET Packer
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:APT_NK_BabyShark_KimJoingRAT_Apr19_1
Create hunting rule
Author:Florian Roth
Description:Detects BabyShark KimJongRAT
Reference:https://unit42.paloaltonetworks.com/babyshark-malware-part-two-attacks-continue-using-kimjongrat-and-pcrat/
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:win_m00nd3v_j1
Create hunting rule
Author:Johannes Bader @viql
Description:detects the M00nD3v keylogger

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

M00nD3v

Executable exe 7fcccc36958bd79308c0a9a1bbb9cf89d025b256dbee80dc9fc2e52f776573d7

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments