MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 97e4b41e30337b05fa008fbb69cbd5f16af2e61067637d1fad45894cfe4c683f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
MassLogger
Vendor detections: 5
| SHA256 hash: | 97e4b41e30337b05fa008fbb69cbd5f16af2e61067637d1fad45894cfe4c683f |
|---|---|
| SHA3-384 hash: | ed495e831cee6a9d3e1be881e6172a86eee5f84f8d581ba0058291976ff1bf24bb9b93f79107c84d7cfecc370dafcc46 |
| SHA1 hash: | be93e17a71c284813fb692b28519cf2af727ba37 |
| MD5 hash: | cf813727378fb5235cd88bec24f5cc56 |
| humanhash: | one-fix-arizona-six |
| File name: | DATASHEET.exe |
| Download: | download sample |
| Signature | MassLogger |
| File size: | 901'120 bytes |
| First seen: | 2020-07-06 07:03:15 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'205 x SnakeKeylogger) |
| ssdeep | 24576:ZjCHiKM0kLcOAJ1WKlQzMA6H8A6iZWbGV9bprxP3Le:ZjCZNkLcOAHWKEMAs625V7rd |
| Threatray | 457 similar samples on MalwareBazaar |
| TLSH | 551512330742FEC7E72D4FB4C18027401EAE956BB720DD897DC822DD51A66D4ABA5A33 |
| Reporter |  abuse_ch |
| Tags: | exe MassLogger |
abuse_ch
Malspam distributing MassLogger:HELO: smtp126.ord1d.emailsrvr.com
Sending IP: 184.106.54.126
From: Martin Václavek <sak@sak-loziska.cz>
Reply-To: me <testing@goodfreightthailand.com>
Subject: URGENT ORDER REQUEST
Attachment: PRODUCT LIST DATASHEET.zip (contains "DATASHEET.exe")
MassLogger SMTP exfil server:
mail.mkontakt.az:587
Intelligence
File Origin
# of uploads :
1
# of downloads :
73
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Detection(s):
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Unauthorized injection to a recently created process
Using the Windows Management Instrumentation requests
Creating a file in the %temp% subdirectories
Reading Telegram data
Reading critical registry keys
Moving a file to the %temp% subdirectory
DNS request
Setting a global event handler for the keyboard
Sending a TCP request to an infection source
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Status:
Malicious
First seen:
2020-07-06 07:05:07 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Similar samples:
+ 447 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
3/10
Tags:
n/a
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Program crash
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.