MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 ae45e49cbf7be00c231c61e41bb4177f9bb6e810607459c29b0642aa1ceec432. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
MassLogger
Vendor detections: 7
| SHA256 hash: | ae45e49cbf7be00c231c61e41bb4177f9bb6e810607459c29b0642aa1ceec432 |
|---|---|
| SHA3-384 hash: | 2c31675e7b11609503ccc8d1cf99add07a90a1fe1278b3049c94896841b874ee585ba7c75178233e78e7ec56d55aa5c5 |
| SHA1 hash: | c7afa80cc3f29761f74e1503f99d1eb0a2987d0b |
| MD5 hash: | fdd3087cedf25914e5446a7d920f260e |
| humanhash: | robin-louisiana-harry-kilo |
| File name: | Hesap hareketleriniz.exe |
| Download: | download sample |
| Signature | MassLogger |
| File size: | 912'896 bytes |
| First seen: | 2020-10-15 12:52:02 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'658 x AgentTesla, 19'469 x Formbook, 12'208 x SnakeKeylogger) |
| ssdeep | 24576:qHnsP+kQ5Y3d4GxKjXEiZyY5sXrbmm5TrHlzAMGec8wj9v7E:gsPs54d4HjXjycsXrqmNrlAMGecZj9vI |
| TLSH | 8715022623A9AFA5E53D573320B5009007F5F156E322DA4E3FE512DC29A2F505B73F2A |
| Reporter |  abuse_ch |
| Tags: | exe geo MassLogger TUR |
Intelligence
File Origin
# of uploads :
1
# of downloads :
96
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Sending a UDP request
Result
Threat name:
MassLogger RAT
Detection:
malicious
Classification:
troj.evad
Score:
88 / 100
Signature
.NET source code contains potential unpacker
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected AntiVM_3
Yara detected MassLogger RAT
Behaviour
Behavior Graph:
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Status:
Malicious
First seen:
2020-10-15 10:55:55 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
5/5
Detection(s):
Suspicious file
Unpacked files
SH256 hash:
ae45e49cbf7be00c231c61e41bb4177f9bb6e810607459c29b0642aa1ceec432
MD5 hash:
fdd3087cedf25914e5446a7d920f260e
SHA1 hash:
c7afa80cc3f29761f74e1503f99d1eb0a2987d0b
SH256 hash:
b4ea84fe078c7e7d2d00bfd9b19e247b545134fce7238fd5ef3a7d1da0c9df21
MD5 hash:
e485f3843a7b2b8c47aea083388b8ff3
SHA1 hash:
5c0cc638dd77bc9947d551ba182324fef209cdb6
SH256 hash:
50bd6df107531d89c7dc74a280dce08302128c797e362167c7c8894eb76d37cb
MD5 hash:
1dc8b599d095fe722b5e68ececcd7138
SHA1 hash:
6527d1f8e27b730307cdb11526c4d2d91db0c577
SH256 hash:
bac5797bde4b2810766a40d95bcdb825ac5b395fcbadd139daa19a44a6cdc049
MD5 hash:
a92cc1f6e0a2742350dfda6726db14c0
SHA1 hash:
e5404e3ed46498deb8ad8966a774540c2b8e9c1e
SH256 hash:
082070df23bcabe35e5255acfdc43c9f0033e92ae48cb5cd6199af7f71d5ab83
MD5 hash:
ed98126e8cdfacf31f7f68ea563c9827
SHA1 hash:
efd863e79981d734e42edbfc81ba5cb505811f2d
Detections:
win_masslogger_w0
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.