MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ac82ad815fbc2727215d5caa1488944d5aa2c29d7820343f85f29c08fbbbfcce. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 7


Intelligence 7 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ac82ad815fbc2727215d5caa1488944d5aa2c29d7820343f85f29c08fbbbfcce
SHA3-384 hash: beb4b65b2653324d474c462bccbd1e0f6ab6072631a3f43ecbf914e1a68a5cd204ea5a345319b96b9124293def1b12e1
SHA1 hash: 8efbfabe22651442df09774e66b08511a294ef10
MD5 hash: 9ed6b78cf806bb6a537ce90afeddba7a
humanhash: triple-south-white-monkey
File name:PAYMENT SWIFT COPY.exe
Download: download sample
Signature MassLogger
Create hunting rule
File size:2'630'640 bytes
First seen:2020-10-06 17:57:17 UTC
Last seen:2020-10-06 19:14:47 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'474 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 49152:U/ahbzGsZ92EGfVBu1Io4iZGdOz5iaKMFl4hev2YcD5Zro8TQm5r:3bzGsv2tfVBu1I1iZ2Oz5HK7hG2YcD5/
TLSH 5EC52315B34CF7B9C07E4930801606932341F3D24DCBA96B7F967DD9E98A6880B56BB3
Reporter abuse_ch
Tags:exe MassLogger

Intelligence

File Origin
# of uploads :
2
# of downloads :
125
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/68653/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Unauthorized injection to a recently created process
Sending a UDP request
DNS request
Sending an HTTP GET request
Using the Windows Management Instrumentation requests
Creating a window
Launching a process
Reading critical registry keys
Sending a custom TCP request
Creating a file
Setting a global event handler for the keyboard
Result
Threat name:
MassLogger RAT
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/483149
Signature
Adds a directory exclusion to Windows Defender
Antivirus / Scanner detection for submitted sample
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for sample
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file access)
Yara detected Costura Assembly Loader
Yara detected MassLogger RAT
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ac82ad815fbc2727215d5caa1488944d5aa2c29d7820343f85f29c08fbbbfcce/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-10-06 16:15:19 UTC
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=vsbk3ak7xqtsoik5lsvbjceujvnkfqu5paqdip4f6koar6537tha._file
Result
Malware family:
n/a
Score:
  10/10
Tags:
spyware
Link:
https://tria.ge/reports/201006-hqc1sa9y1n/
Behaviour
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Looks up external IP address via web service
Checks computer location settings
Reads user/profile data of web browsers
Unpacked files
SH256 hash:
ac82ad815fbc2727215d5caa1488944d5aa2c29d7820343f85f29c08fbbbfcce
MD5 hash:
9ed6b78cf806bb6a537ce90afeddba7a
SHA1 hash:
8efbfabe22651442df09774e66b08511a294ef10
Link:
https://www.unpac.me/results/86919b89-44be-4303-b9a5-02d0e1bf6a54/
SH256 hash:
2904c66b0d26f940b29ff4dffe3c6e28dfb6e9324de3913bcdf9de4d6531643c
MD5 hash:
ed32494c6128418cdcd0fc9200aa6f9b
SHA1 hash:
5becf1881eddb78c29275725fc075a5bf7ff8068
Detections:
win_masslogger_w0
Create hunting rule
Link:
https://www.unpac.me/results/86919b89-44be-4303-b9a5-02d0e1bf6a54/
Parent samples :
ac82ad815fbc2727215d5caa1488944d5aa2c29d7820343f85f29c08fbbbfcce
18a6b8961bad38e78e24206c4716dc311c53ba24c4d930fc32e4a70b3821b6f4
SH256 hash:
42225c42ce5871ba8dffa457be59195e816d47f167d5a5951b9a7ba1f9469568
MD5 hash:
c3239b0d45bbe8b3a4e381b9bb7e74b9
SHA1 hash:
19e190e7a7d4304233942bacbe440880396e614d
Link:
https://www.unpac.me/results/86919b89-44be-4303-b9a5-02d0e1bf6a54/
SH256 hash:
abe9d2269eed033cebd2fada2af3082ef7c8610c166cfe9672aafd894f35f6a8
MD5 hash:
21bfd6706cca963d3ec39234a5af71da
SHA1 hash:
8ab0b2ab5edce8c55166c60bc859b1ae19dd9fba
Link:
https://www.unpac.me/results/86919b89-44be-4303-b9a5-02d0e1bf6a54/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ac82ad815fbc2727215d5caa1488944d5aa2c29d7820343f85f29c08fbbbfcce

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:masslogger_gcch
Create hunting rule
Author:govcert_ch
Rule name:win_masslogger_w0
Create hunting rule
Author:govcert_ch

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/68653/

Comments