MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 851f1641fb283113cc5feb03c807bc82dc4d85ecd22ab8ff091a8edd71bb45ed. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

MassLogger

Vendor detections: 3

Intelligence 3 IOCs YARA 1 File information Comments

SHA256 hash:	851f1641fb283113cc5feb03c807bc82dc4d85ecd22ab8ff091a8edd71bb45ed
SHA3-384 hash:	ad2992102d9e4c6c13a894082045cbcbe432a3739d958557a97389a1ed5a472421e456a87846f020dfd27c713f8a3070
SHA1 hash:	5d7a1f8777069ac6462cdcd7aaa885b10e23472f
MD5 hash:	4400d1b5d0c379b8e5dade14b3346569
humanhash:	eighteen-mike-five-carpet
File name:	RFQ #031-24062020.exe
Download:	download sample
Signature	MassLogger Create hunting rule
File size:	747'008 bytes
First seen:	2020-06-24 07:44:30 UTC
Last seen:	2020-06-24 14:50:15 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'452 x Formbook, 12'202 x SnakeKeylogger)
ssdeep	12288:DQxNMfw1koyQh2MZ4MUbJTP/DIqQKNwjEsp4mFbWcCTjIUEg7KU8yEhfX2Gv:IN73y8YJ7I5jxLbWcC4Q7l8hGGv
Threatray	774 similar samples on MalwareBazaar
TLSH	C4F41207378CFA27C67D15F4D4D28B4812F256AAA292F7DE6CC026E554C37F84962AC3
Reporter	abuse_ch
Tags:	exe MassLogger

abuse_ch

Malspam distributing MassLogger:

HELO: umacintl.com
Sending IP: 37.49.224.135
From: Chandana <techex@umacintl.com>
Subject: Confirmation order: RFQ #031-24062020
Attachment: RFQ 031-24062020.zip (contains "RFQ #031-24062020.exe")

MassLogger SMTP exfil server:
mail.privateemail.com:587

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/13581/

Detection(s):

SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

Launching a process

Creating a process with a hidden window

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/851f1641fb283113cc5feb03c807bc82dc4d85ecd22ab8ff091a8edd71bb45ed/

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2020-06-24 07:46:06 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

22 of 29 (75.86%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=quprmqp3fayrhtc75mb4qb54qloe3bpm2ivlr7yjdkhn24n3ixwq._file

Verdict:

unknown

MassLogger

4067a7bbd1a542f2d386e5bc991bb5573f0d637efd8a172af6e928a409e04359

MassLogger

51cd50a11b008b97589100b5233bf8ce7926dd49bb197ef45abd62788c5fdbcc

MassLogger

69e1a15be2f6adc6268ec617568b3d2725122eb8d34873c23a7117b24e8b6854

MassLogger

7a0a4bf28716c9ac171759a0a36c3d3b0edcbd4e1b55569d6e5e9063f5b3ca87

MassLogger

7dfe5d9e3e099285a3bc63497d1ee47ac99b7012f23beb730d73557b40afa26c

MassLogger

8470a2e93ae48abb1b987d9927277eb7a3bde99fe0d048274f839cc25aa3aa95

MassLogger

a9316a887a00dbf992833394b7a4e05db6e6e6929f66419a06ebbccf358e45b4

MassLogger

b8214924a598b9fd3193099fecd6c3d09f06dc5e3a9af098642c7d5327c05cd3

MassLogger

f54e2a18f9a6b1f5fa144306a9ad3e277e0dfa581543c5156a6a59b644c913da

MassLogger

+ 764 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

1/10

Tags:

n/a

Link:

https://tria.ge/reports/200624-q47yx3te8s/

Behaviour

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Creates scheduled task(s)

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.