MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9dd080791798299a75121d5573cbbc91bbf464e537744fba0f6d5c329d6d4ff4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

MassLogger

Vendor detections: 4

Intelligence 4 IOCs YARA 1 File information Comments

SHA256 hash:	9dd080791798299a75121d5573cbbc91bbf464e537744fba0f6d5c329d6d4ff4
SHA3-384 hash:	98f894d419ed92b9875d9a379fc2c435e63bce466c5f76521031c5b6467a6d73e12d15d4b3b1d2a03f9e2485e06ffd43
SHA1 hash:	95867cb030559815109c728e654217ad588f23a7
MD5 hash:	5de006d8bfd5139ebabb8a8ff7271d81
humanhash:	mexico-robert-leopard-five
File name:	Purchase Order.exe
Download:	download sample
Signature	MassLogger Create hunting rule
File size:	815'616 bytes
First seen:	2020-06-16 05:20:38 UTC
Last seen:	2020-06-17 04:58:20 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'655 x AgentTesla, 19'464 x Formbook, 12'205 x SnakeKeylogger)
ssdeep	24576:GSjpubCzKajmKcm4CvpBJqD7rStlFaab8:GSFu3aIm4CvpO3SFP
Threatray	1'057 similar samples on MalwareBazaar
TLSH	F9052305B64C5624C2BC4BBE98D51A8403F7A5361A33E71E9E8C362C1E73BE4D252F17
Reporter	cocaman
Tags:	exe MassLogger

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/10565/

Detection(s):

SecuriteInfo.com.Trojan.GenericKD.34016426.19424.29719.UNOFFICIAL

Gathering data

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2020-06-15 20:23:56 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

24 of 29 (82.76%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=txiia6ixtauzu5isdvkxhs54sg57izhfg52e7oqpnvodfhlnj72a._file

Verdict:

suspicious

MassLogger

3f8c2a8d34d7d3f61451ea1beb9d9671cc50aa2cbe39d700a08d0215b8b7163b

MassLogger

6a812ee04fdb54b0576e2e51bb705d2a7f2d14f86601f718385087310a3df257

MassLogger

7039c80d82fdcfed16711652027522d8a99a311be6a1ceed3c25776a495968de

MassLogger

7758c91a218460dfc6cc95e5c106c50431cdd6cad667b4e8c98bee960ff06b3a

MassLogger

addd02b5623bb29f4cb564b9c228184123a33a94e8308a28c8e74be662e120b3

MassLogger

b04d6c5e4e1759d306dbec63b416be318058ff1698e8ff4b022bad89c7636e29

MassLogger

d97d1614a199d784c0697ff01eff3e4d195dd07e65879a59b3b805d2088ad8a9

MassLogger

debcd0af0a58eb42e8547392527d9daf5993826d3b53f795369d712c48ac2b12

MassLogger

e86863fab85a50441e0e576550d74ef97d8a3e82085ead6e5fae22930de1866c

MassLogger

+ 1'047 additional samples on MalwareBazaar

Result

Malware family:

masslogger

Score:

10/10

Tags:

family:masslogger ransomware rezer0 spyware stealer

Link:

https://tria.ge/reports/201109-fjqh9f44c6/

Behaviour

Suspicious behavior: AddClipboardFormatListener

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Looks up external IP address via web service

Checks computer location settings

Reads user/profile data of web browsers

rezer0

MassLogger

MassLogger Main Payload

MassLogger log file

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.