MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a7b3205188377f0228f645addd0b60c1e4e1277b52cd1f1f2372e1e859c86b4a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

MassLogger

Vendor detections: 10

Intelligence 10 IOCs YARA 6 File information Comments

SHA256 hash:	a7b3205188377f0228f645addd0b60c1e4e1277b52cd1f1f2372e1e859c86b4a
SHA3-384 hash:	d59f304c56cd80fd53b1b3abebdb21d2cc4461b45c34eee5c1e4e3582edfbc7c6efd4f824fc6f5f548a6779ce606f00c
SHA1 hash:	849db9f3d3def29528e05ef6403def931069e7ef
MD5 hash:	4d69508bcdc6c592d152f87a94e2765c
humanhash:	oregon-failed-single-uranus
File name:	BL-100410364195.7z
Download:	download sample
Signature	MassLogger Create hunting rule
File size:	501'239 bytes
First seen:	2024-12-07 08:05:52 UTC
Last seen:	Never
File type:	7z
MIME type:	application/x-7z-compressed
ssdeep	12288:eAKiQs4w90dAG2Mx2EfJwwswsfMXvEWJQEPZzFZ:eNZ3xA3VaqwdsfMcLEbZ
TLSH	T1C6B42302D89FD8EAE6C4428D299AC2D348B0BB2B4552FC5E3F3956718D71E709DB017B
TrID	57.1% (.7Z) 7-Zip compressed archive (v0.4) (8000/1) 42.8% (.7Z) 7-Zip compressed archive (gen) (6000/1)
Magika	sevenzip
Reporter	mamrmu
Tags:	7z MassLogger

Intelligence

File Origin

# of uploads :

# of downloads :

121

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	BL-100410364195.exe
File size:	1'190'400 bytes
SHA256 hash:	b74937d0f19896f2d3256daf121395e8fcea20c8a509fac8fd5ebb95306fd00b
MD5 hash:	3b536d0bb93360729b7119e8ee265c61
MIME type:	application/x-dosexec
Signature	MassLogger

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.BehavesLike.Win32.Generic.vh.UNOFFICIAL

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=675401ec03fccedbc649b20c

Tags:

masslogger nymeria autoit emotet

Result

Verdict:

Malicious

File Type:

PE File

Link:

https://app.docguard.net/a7b3205188377f0228f645addd0b60c1e4e1277b52cd1f1f2372e1e859c86b4a/results/dashboard

Behaviour

BlacklistAPI detected

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

adaptive-context autoit compiled-script evasive fingerprint fingerprint keylogger lolbin microsoft_visual_cc msconfig

Link:

https://www.filescan.io/uploads/675401ea901b5215ed08ff22/reports/9a5a24f2-5114-4b50-83f6-d24959ecee74/overview

Verdict:

Malicious

Labled as:

Trojan.PasswordStealer.GenericS

Link:

https://www.hybrid-analysis.com/sample/a7b3205188377f0228f645addd0b60c1e4e1277b52cd1f1f2372e1e859c86b4a

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Score:

96%

Verdict:

Malware

File Type:

Result

Malware family:

n/a

Score:

6/10

Tags:

collection discovery

Link:

https://tria.ge/reports/241207-kybhcsvqcy/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/a7b3205188377f0228f645addd0b60c1e4e1277b52cd1f1f2372e1e859c86b4a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	AutoIT_Compiled Create hunting rule
Author:	@bartblaze
Description:	Identifies compiled AutoIT script (as EXE). This rule by itself does NOT necessarily mean the detected file is malicious.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	RansomPyShield_Antiransomware Create hunting rule
Author:	XiAnzheng
Description:	Check for Suspicious String and Import combination that Ransomware mostly abuse(can create FP)

Rule name:	SUSP_Imphash_Mar23_3 Create hunting rule
Author:	Arnim Rupp (https://github.com/ruppde)
Description:	Detects imphash often found in malware samples (Maximum 0,25% hits with search for 'imphash:x p:0' on Virustotal) = 99,75% hits
Reference:	Internal Research

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)