MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9b5b44ded4ede28d92834c4db286780a5628d02597a739ff3633f808d47f0939. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9b5b44ded4ede28d92834c4db286780a5628d02597a739ff3633f808d47f0939
SHA3-384 hash: 9ad08e4099aa42979fe5a477f5ddfcb56adad0ae2bfb6bbc1b5ebfe7982c7fea216675291cec9131a02fd67fa8abd9da
SHA1 hash: 875d11eff55334ee4023c652426bdbb01df441c5
MD5 hash: c5b8a9626e84da89963aada81e6a9342
humanhash: aspen-green-louisiana-jupiter
File name:MnxI7xB3qhnOgc4.exe
Download: download sample
Signature MassLogger
Create hunting rule
File size:1'004'032 bytes
First seen:2020-06-11 07:54:30 UTC
Last seen:2020-06-11 10:44:10 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'600 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 24576:oBLABBeocrPqtaTVSLpt4ao3TKvODPla2tg:oBMyRbRTMVGzDPl7
Threatray 3'688 similar samples on MalwareBazaar
TLSH C925F10136D1AE8EC67F8DB3896719109BF0A5677E1BF2835C8B16DB106DF864B40B4B
Reporter jarumlus
Tags:AgentTesla MassLogger

Intelligence

File Origin
# of uploads :
2
# of downloads :
73
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/8963/
Detection(s):
SecuriteInfo.com.MSIL.GenKryptik.EMGD.27850.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-11 08:13:32 UTC
AV detection:
25 of 31 (80.65%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=tnnujxwu5xri3eudjrg3fbtybjlcrubfs6ttt7zwgp4arvd7be4q._file
Verdict:
malicious
Similar samples:
21cf18a3f7318d77dbab369b9095a9f18a5e46b6b99608d5a3d69c3ecd70be06
MassLogger
2a9ff7b8ca6a12f714779ecdcd2d86ccf9ad03da04de4a45aa8c3c97b7209c8f
MassLogger
3c12197e1c9c3d04c5831d3633fcda64dd51bd7c7d31db7ca42fafe341f7a3ee
MassLogger
532b875f09991cdf7b57db59f0f7aa579d49b229d65ad1ace9f67bf6ffc7bca5
MassLogger
5f2517598649fe78e58966a15e9fea89e43ee57aa0ad6b779ef18be53eb39a2b
MassLogger
60da286e39c0c6dcee0d9daafbf5c6662b818c9a36b77d8ba5f4314e94d9baea
MassLogger
6d54c4bdd7149e81dc967e55ae893f4120d53d511253f829ae6881501b0a18ff
MassLogger
ba19f152a61cf84f2a2f1d5bb1f7dc7861a8c234bb358bd5bb7d2cceb4523fc9
MassLogger
c8e57eaa8b0fcdfa8cd3db86591975ed151c5e1751997a94fb0d9dddf62aecba
MassLogger
e5cc23bfa0f9589308e2c6b099bd6400687ac3670cc9cc6e13bc6d671ed66fce
MassLogger
+ 3'678 additional samples on MalwareBazaar
Result
Malware family:
masslogger
Create hunting rule
Score:
  10/10
Tags:
family:masslogger ransomware rezer0 spyware stealer
Link:
https://tria.ge/reports/201109-1n4rk4ttda/
Behaviour
Creates scheduled task(s)
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Looks up external IP address via web service
Checks computer location settings
Reads user/profile data of web browsers
rezer0
MassLogger
MassLogger Main Payload
MassLogger log file
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:masslogger_gcch
Create hunting rule
Author:govcert_ch

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

Word file doc 3d65a232db7493a0b4374a54c4f90784a942ba7c5e3b2c7c2399999e22437505

MassLogger

Executable exe 9b5b44ded4ede28d92834c4db286780a5628d02597a739ff3633f808d47f0939

(this sample)

  
Dropped by
MD5 15aa4c07809a1136143e1ff4019da257
  
Dropped by
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
URLhaus
https://urlhaus.abuse.ch/url/386533/
  
Dropped by
SHA256 3d65a232db7493a0b4374a54c4f90784a942ba7c5e3b2c7c2399999e22437505
Cape
Cape
https://www.capesandbox.com/analysis/8963/

Comments