MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 9e184fecd3e0be67e11c78d407fe8e1f5f75573b32801bf00055745ef3c86225. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
MassLogger
Vendor detections: 10
| SHA256 hash: | 9e184fecd3e0be67e11c78d407fe8e1f5f75573b32801bf00055745ef3c86225 |
|---|---|
| SHA3-384 hash: | 904227d46dd204e8b3d296ed02d5faef1f3d9d1e448b3ccac86eb18cdd6ce7756878f4c8198231a382c91ed739839f02 |
| SHA1 hash: | 72af245683b018fb46684d07545ebd9e3dc8d0f0 |
| MD5 hash: | 024ca03cfeb3ccac67e8516ad12b896d |
| humanhash: | south-echo-carbon-alaska |
| File name: | TJKjGvC3dP2CIDi.exe |
| Download: | download sample |
| Signature | MassLogger |
| File size: | 1'432'064 bytes |
| First seen: | 2020-10-23 11:39:39 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger) |
| ssdeep | 24576:jo5jyfEkrJ9h07EGfelhukuWB4/xXVQ6Lggg0T+PIIETNOe:jUjyfEkrJ7y2ukuWAW6Lg90fJB |
| Threatray | 445 similar samples on MalwareBazaar |
| TLSH | 2565F10223E85F54F5BF93389868000097F9BD06A727E7ADBDD050DF1DA2F818B5676A |
| Reporter |  abuse_ch |
| Tags: | exe GarantiBBVA geo MassLogger TUR |
abuse_ch
Malspam distributing MassLogger:HELO: m1mkyc5j.ni.net.tr
Sending IP: 89.252.168.58
From: Garanti BBVA Emeklilik <OtomatikBES@garantibbvaemeklilik.com.tr>
Reply-To: noreply <mintchin1@gmail.com>
Subject: Otomatik BES İşlemleri Son Aşama - Ödeme Dosyanızı Yükleyin
Attachment: 42800.rar (contains "TJKjGvC3dP2CIDi.exe")
Intelligence
File Origin
# of uploads :
1
# of downloads :
131
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Masslogger
Result
Verdict:
Malware
Maliciousness:
Behaviour
Sending a UDP request
Creating a window
Unauthorized injection to a recently created process
Creating a file
Running batch commands
Launching a process
Result
Threat name:
MassLogger RAT
Detection:
malicious
Classification:
troj.evad
Score:
88 / 100
Signature
.NET source code contains potential unpacker
Binary contains a suspicious time stamp
Deletes itself after installation
Injects a PE file into a foreign processes
Machine Learning detection for sample
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected AntiVM_3
Yara detected Costura Assembly Loader
Yara detected MassLogger RAT
Behaviour
Behavior Graph:
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Status:
Malicious
First seen:
2020-10-23 09:35:06 UTC
AV detection:
23 of 27 (85.19%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Label(s):
masslogger
Similar samples:
+ 435 additional samples on MalwareBazaar
Result
Malware family:
masslogger
Score:
10/10
Tags:
ransomware spyware stealer family:masslogger
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Looks up external IP address via web service
Checks computer location settings
Reads user/profile data of web browsers
MassLogger
MassLogger Main Payload
MassLogger log file
Unpacked files
SH256 hash:
7cc76d40ec8a597b832ca59d05cdbd04604e4b5bc8d63d192aefd9d9950570c7
MD5 hash:
573f4cd85bd963f6873031bb0ac22f12
SHA1 hash:
59f46ac28e93b498118ff8571d042c738c24806c
SH256 hash:
62a21907cd6834095979b4e3017e5a475463b7127bdd32b88a62b540503dd307
MD5 hash:
6b6e65bed0fa0826cf60dbc954adaa91
SHA1 hash:
5de779a275e81112bf82378c3d4f874286b712e2
SH256 hash:
e5009b34bddaab2a163b6f5e252f0d47310c94a9eb9150bf7823c95f2d157d84
MD5 hash:
88753aa9305fb14477481a510c9c9c52
SHA1 hash:
e39739acc3b8ca5d61bd623fec16069e3b8ef568
Detections:
win_masslogger_w0
SH256 hash:
bac5797bde4b2810766a40d95bcdb825ac5b395fcbadd139daa19a44a6cdc049
MD5 hash:
a92cc1f6e0a2742350dfda6726db14c0
SHA1 hash:
e5404e3ed46498deb8ad8966a774540c2b8e9c1e
SH256 hash:
ad37f6f43871113f463e286073ac3e7439b2c432fdda6fcfb94bba7e3ab8dd07
MD5 hash:
eee4ced669ee363e4e2713dbb491e945
SHA1 hash:
55aed0e8b827915055ab25847a4d0891c7e8a253
SH256 hash:
9e184fecd3e0be67e11c78d407fe8e1f5f75573b32801bf00055745ef3c86225
MD5 hash:
024ca03cfeb3ccac67e8516ad12b896d
SHA1 hash:
72af245683b018fb46684d07545ebd9e3dc8d0f0
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.