MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 994efe7e189b31c6b3911302a077eadea90e4c0eefc6e54dd64b3dfa0b16124f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

MassLogger

Vendor detections: 4

Intelligence 4 IOCs YARA 1 File information Comments

SHA256 hash:	994efe7e189b31c6b3911302a077eadea90e4c0eefc6e54dd64b3dfa0b16124f
SHA3-384 hash:	e84f0a5d6a14bea7926dbf22d076a57b7ebe77a1de5ea2fe4002f121b551043a4782d99fb3e64efda0ef6ba905884146
SHA1 hash:	f6e1deba2f671c05e26bfe5687323b29b415eaf8
MD5 hash:	ff08c41c8548de0a1b48ac7e538feed0
humanhash:	cat-spaghetti-indigo-bravo
File name:	74658786798.exe
Download:	download sample
Signature	MassLogger Create hunting rule
File size:	1'256'448 bytes
First seen:	2020-05-25 12:32:56 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'602 x Formbook, 12'241 x SnakeKeylogger)
ssdeep	12288:dGeNg1xZmflE7AGgEMdw1i9wQwhDzPB5eaBHBEjplKlY79D9Cx:doxofTuMddC1hDTB5dAlw+HW
Threatray	687 similar samples on MalwareBazaar
TLSH	05455B2A30C68404C5289636407AA9C5E7E6B7803666C72EFAAF534B5F03F2F77115DE
Reporter	abuse_ch
Tags:	ESP exe geo MassLogger Santander

abuse_ch

Malspam distributing MassLogger:

HELO: marathon.dnssw.net
Sending IP: 81.25.112.50
From: Factoring y Confirming - Grupo Santander <fycout@gruposantander.com>
Subject: Confirming - Aviso de pago
Attachment: 74658786798.GZ (contains "74658786798.exe")

MassLogger SMTP exfil server:
smtp.mail.ru:587

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Gathering data

Threat name:

ByteCode-MSIL.Trojan.Injector

Status:

Malicious

First seen:

2020-05-25 12:37:06 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

18 of 31 (58.06%)

Threat level:

2/5

Verdict:

malicious

Label(s):

nanocorerat

MassLogger

51b738c591772ec3db02cf7406b83f1527ff697d2da54e1da02069f9720f0495

MassLogger

53b4179d18dc27443d5182752aaf6d78253ec7fc4eac192dcf6078884af51535

MassLogger

61f71454eee2bb4a8de161e795ff31da2cec631df0582a30fd7cceb54ae02892

MassLogger

70e0116e04e3ff9cdd2d500e2ec54946f3380c0a0e9e74ada84f1d1638e89223

MassLogger

79a191033da8c7040b19ef97042dcef88669f15b784d881cbb5b8ace51cf26ce

MassLogger

91ab9b169f8b0c05ab795c52b0e41f34374bb828c16176eda1f121c1dbc12731

MassLogger

92fe26c8230e536786caaa0932023f795e94d364ef3221a728d81d7ef90afd2a

MassLogger

a97835df055504850909bdb785d2bd535cc22702f418147cc3af6d4add370a59

MassLogger

db6d686590ded24cbfc0dfb2be4cd25035d7422c4cf49e6b9bf94469d2573e7d

MassLogger

+ 677 additional samples on MalwareBazaar

Result

Malware family:

masslogger

Score:

10/10

Tags:

family:masslogger agilenet ransomware spyware stealer

Link:

https://tria.ge/reports/201109-ta4lez3lqe/

Behaviour

Creates scheduled task(s)

Suspicious behavior: AddClipboardFormatListener

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Looks up external IP address via web service

Checks computer location settings

Loads dropped DLL

Obfuscated with Agile.Net obfuscator

Executes dropped EXE

MassLogger

MassLogger log file

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.