MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 96a285dfae4b3ac722a9585a75a6b604158d599af23925f7e2355b339751a88e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

MassLogger

Vendor detections: 5

Intelligence 5 IOCs YARA 1 File information Comments

SHA256 hash:	96a285dfae4b3ac722a9585a75a6b604158d599af23925f7e2355b339751a88e
SHA3-384 hash:	650df4c733808bc3f00619be90855bf03b53a55e12a2bf1be860772c43c6f269f342f8df8980560a0d524727b7b840b0
SHA1 hash:	69a53e9b8a61dec98bf062cb2129d3dae76cb7da
MD5 hash:	e1e930614a675a55343ae7c186d2e811
humanhash:	lamp-uranus-fanta-hotel
File name:	Payment Copy...exe
Download:	download sample
Signature	MassLogger Create hunting rule
File size:	943'104 bytes
First seen:	2020-06-24 06:33:50 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'600 x Formbook, 12'241 x SnakeKeylogger)
ssdeep	24576:c0NSJDKNfkDIEACbnV4s8LjO3YEsAKkxsed9i:OWqb1msfYEHK8dg
Threatray	575 similar samples on MalwareBazaar
TLSH	7A15121B635CBA27C6BC26F5A0C25F0423B65CAF75A3F6C96CC025BA50E63F50A106D7
Reporter	abuse_ch
Tags:	exe MassLogger

abuse_ch

Malspam distributing MassLogger:

HELO: hwsrv-743276.hostwindsdns.com
Sending IP: 23.254.231.29
From: Juan Avalos <Salespoland@damco.com>
Reply-To: avajuan939@gmail.com
Subject: OVERDUE INVOICE
Attachment: Payment Copy..r11 (contains "Payment Copy...exe")

MassLogger SMTP exfil server:
mail.tcsqatar.com:587

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/13480/

Detection(s):

SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/96a285dfae4b3ac722a9585a75a6b604158d599af23925f7e2355b339751a88e/

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2020-06-24 06:35:08 UTC

AV detection:

24 of 31 (77.42%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=s2rilx5ojm5moivjlbnhljvwaqky2wm26i4sl57cgvnthf2rvcha._file

Verdict:

malicious

MassLogger

2cf0748f853ea89cc9573f7b6f3c6edeab4e4a6611ef5ea33320da6eaa8aac3d

MassLogger

8470a2e93ae48abb1b987d9927277eb7a3bde99fe0d048274f839cc25aa3aa95

MassLogger

8bc95f1ba65bf54858a20c62bf09e9e39027f8be74369c25401b5e4503b1b553

MassLogger

99a8b22ec655fd50aa2bdb93b05e8533ec539feeffacf592cf038a6ede299314

MassLogger

9d659a53442b83dc3f5e3a7b3bb8ad90cdc1f06c258f074791a7efccb46f867e

MassLogger

a2a20ca278f96e4a0d3c7ab190153021f207843052ae5da1f835ae3d913fcbec

MassLogger

a695f00451136422236ac536e9a7417a8826001ecb0ba51e582687cb0dc3f0ba

MassLogger

b8892e7eafba52a3b311d7741d89363ec9d52b8d1fd180ea32385be609a6b9e8

MassLogger

c38c88878a7c284cd19149b2efb91129b16ae51c6ff32badb2622122185f1692

MassLogger

+ 565 additional samples on MalwareBazaar

Result

Malware family:

masslogger

Score:

10/10

Tags:

ransomware spyware stealer family:masslogger

Link:

https://tria.ge/reports/200624-lttppeckxa/

Behaviour

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: AddClipboardFormatListener

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

Creates scheduled task(s)

Suspicious use of SetThreadContext

Looks up external IP address via web service

Reads user/profile data of web browsers

MassLogger

MassLogger log file

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.