MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 a8883460eb4eda4b981767c15ae6fadf5dd2c5ff7d8d8325b417bbdf71dece1a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
MassLogger
Vendor detections: 7
| SHA256 hash: | a8883460eb4eda4b981767c15ae6fadf5dd2c5ff7d8d8325b417bbdf71dece1a |
|---|---|
| SHA3-384 hash: | 8b7b65ea0233bbb99843ff5df0d81141b96b26b3019d9f6d5c811a12aca6eee87036b6360397cf0f1e19346eb93fae05 |
| SHA1 hash: | b31d955bbe163724ee0373bce0d06d73cc7914a3 |
| MD5 hash: | e5099a7241b5b9ff80c8180821a4b148 |
| humanhash: | equal-pizza-twenty-romeo |
| File name: | CKC.bin |
| Download: | download sample |
| Signature | MassLogger |
| File size: | 1'154'048 bytes |
| First seen: | 2020-11-17 10:58:17 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger) |
| ssdeep | 24576:dWxp9BKrRFOe95JD8NsLXCUtmeZyjlCb:sxpTMRFT9rFCUVeCb |
| Threatray | 528 similar samples on MalwareBazaar |
| TLSH | DF35F150768452E7EDB889721311F2700A223CBFC7ADE66660D43F271A753CB9921FE9 |
| Reporter |  JAMESWT_WT |
| Tags: | MassLogger |
Intelligence
File Origin
# of uploads :
1
# of downloads :
83
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
Malware
Maliciousness:
Behaviour
Sending a UDP request
Creating a file in the %AppData% subdirectories
Unauthorized injection to a recently created process
Creating a file
DNS request
Sending an HTTP GET request
Using the Windows Management Instrumentation requests
Creating a window
Reading critical registry keys
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Setting a global event handler for the keyboard
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Threat name:
ByteCode-MSIL.Trojan.NanoBot
Status:
Malicious
First seen:
2020-11-17 10:18:54 UTC
File Type:
PE (.Net Exe)
Extracted files:
11
AV detection:
23 of 29 (79.31%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Label(s):
masslogger
Similar samples:
+ 518 additional samples on MalwareBazaar
Result
Malware family:
masslogger
Score:
10/10
Tags:
family:masslogger persistence spyware stealer
Behaviour
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Adds Run key to start application
Looks up external IP address via web service
Checks computer location settings
Reads user/profile data of web browsers
MassLogger
MassLogger Main Payload
Unpacked files
SH256 hash:
a8883460eb4eda4b981767c15ae6fadf5dd2c5ff7d8d8325b417bbdf71dece1a
MD5 hash:
e5099a7241b5b9ff80c8180821a4b148
SHA1 hash:
b31d955bbe163724ee0373bce0d06d73cc7914a3
SH256 hash:
c592e2eebb598b1133362b644b271ff18de817b8472cf7233c11abad9eac4e43
MD5 hash:
9e667eb5feadaf159563bf16d8badf5d
SHA1 hash:
05a15e0cceb97435539d038367ba76b47363d136
SH256 hash:
e68094689820e25e0a8f0e0a96a9e98ae4c017e96e8c81aa21177d09085fd616
MD5 hash:
e7afb6081719df4bf65616f35ddbdcc0
SHA1 hash:
57856f8a5d0768465cd498b1e5ab8eee8c5b0989
SH256 hash:
efc52de41a472596f9b39e2601d3e4151ee196702197c47987ec26a6811e1ee7
MD5 hash:
37ee61b2659f1eb883ed2684d3205a39
SHA1 hash:
84c4c589248951c593f8887f9261cd8d8eb4f471
Detections:
win_masslogger_w0
SH256 hash:
83c08f0721c8b0c96e3d6a8f3ccaf5c96fbcc427d574625c34424c3429fefaa1
MD5 hash:
3c5dbcc3bb27e913e14efd8054811373
SHA1 hash:
b0eba9388abddaef9d5aa49ccd5dbab2924cced0
Please note that we are no longer able to provide a coverage score for Virus Total.
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | Keylog_bin_mem |
|---|---|
| Author: | James_inthe_box |
| Description: | Contains Keylog |
| Rule name: | MassLogger |
|---|---|
| Author: | kevoreilly |
| Description: | MassLogger |
| Rule name: | masslogger_gcch |
|---|---|
| Author: | govcert_ch |
| Rule name: | win_masslogger_w0 |
|---|---|
| Author: | govcert_ch |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.