MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8e4b63db4255d1428f0856d7e89ab1c147599416d8edd4e4e506d3f0420d77a4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

MassLogger

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	8e4b63db4255d1428f0856d7e89ab1c147599416d8edd4e4e506d3f0420d77a4
SHA3-384 hash:	c248df7178d08709aad07249a43368229da1e5af65c0a2cce11a5366805b7afbd0800e3b82b1bbb06331494b74573326
SHA1 hash:	c564ae6e5237a0592348fbd2ddca17019af30cce
MD5 hash:	831bc6aea2b3178001e0116db0d380da
humanhash:	wolfram-alpha-network-helium
File name:	SecuriteInfo.com.Fareit-FXH831BC6AEA2B3.23278
Download:	download sample
Signature	MassLogger Create hunting rule
File size:	1'291'264 bytes
First seen:	2020-07-17 04:34:58 UTC
Last seen:	2020-07-17 05:29:58 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep	24576:lrvxguwcLjrkDp1Rs0rPjsMLY3pT3aCpdJslyBh:Rx1LYpYaPjNLuDrdJslyBh
Threatray	739 similar samples on MalwareBazaar
TLSH	E7558DF39A59C1C1C49F9EB8C992C7710A97EDC0F0F5920B02E67C2736767A1E88546B
Reporter	SecuriteInfoCom
Tags:	MassLogger

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Gathering data

Detection(s):

SecuriteInfo.com.Fareit-FXH831BC6AEA2B3.23278.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Launching a process

Creating a process with a hidden window

Result

Threat name:

MassLogger RAT

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/388880

Signature

Found malware configuration

Machine Learning detection for dropped file

Machine Learning detection for sample

May check the online IP address of the machine

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sigma detected: Scheduled temp file as task from temp location

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file access)

Uses schtasks.exe or at.exe to add and modify task schedules

Yara detected MassLogger RAT

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/8e4b63db4255d1428f0856d7e89ab1c147599416d8edd4e4e506d3f0420d77a4/

Threat name:

ByteCode-MSIL.Infostealer.Fareit

Status:

Malicious

First seen:

2020-07-17 04:35:24 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

24 of 29 (82.76%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=rzfwhw2ckxiufdyik3l6rgvryfdvtfaw3dw5jzhfa3j7aqqno6sa._file

Verdict:

unknown

MassLogger

540a1ab8a63b1b07ea3d80939868a94dafb79f6e2fc37a8a2cc22ded21c60deb

MassLogger

750fad3db3f495fec07ac204f7e3717e75324ea9beed2fce1c48350015b888c5

MassLogger

7d3633f4d63dd8e95075561828126a43b45cd0687c7e9fd58a8e556c311f5519

MassLogger

8aef7422bb8ccc4560fb78875a0fb5d4644108a905febacd2b609012930e5744

MassLogger

bac48e9a9fad6c9afa0387fe592bb1eabd56cfbcbffef2bbc765e32de2846478

MassLogger

d5151bd37aa74ce1a5782e72bf26630f2df07f1e7cbeb42f45aa2f49645c35a8

MassLogger

dd0b44aeb504ee47ac61b86d092f14b7f3955b76c4b227458237acc4c9f55663

MassLogger

faf1dca0b043816dc1a448c778e8fc03030add15983e04a7cc39851297615c4f

MassLogger

fe7d67f2ca207d604740c8e66d22638049ca8a0c40818ad9f1d8515d6912f16d

MassLogger

+ 729 additional samples on MalwareBazaar

Result

Malware family:

masslogger

Score:

10/10

Tags:

ransomware stealer spyware family:masslogger

Link:

https://tria.ge/reports/200717-mm2k8qfty2/

Behaviour

Creates scheduled task(s)

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

Suspicious behavior: AddClipboardFormatListener

Suspicious use of SetThreadContext

Looks up external IP address via web service

Reads user/profile data of web browsers

MassLogger

MassLogger log file

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Unknown

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/8e4b63db4255d1428f0856d7e89ab1c147599416d8edd4e4e506d3f0420d77a4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.