MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ae827e126c9f242564090fd5cb50ab392d61eae0f8dc1d43654bcb16aeeadc2e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ae827e126c9f242564090fd5cb50ab392d61eae0f8dc1d43654bcb16aeeadc2e
SHA3-384 hash: 909060d9d5cdee53743e14a223f7c05e1bf5c130ca58b63f7ec5edb1a81e5dcb8d437a21708f5eb09ed77623d15272e8
SHA1 hash: 1d5b7739853f22b5e21cb268fa2a93e3784a2f71
MD5 hash: f609ce87aafcf5e6cfdaf61cc10a8d3d
humanhash: potato-sad-eighteen-finch
File name:HealthCare_Product.exe
Download: download sample
Signature MassLogger
Create hunting rule
File size:929'280 bytes
First seen:2020-05-26 07:51:56 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'748 x AgentTesla, 19'643 x Formbook, 12'245 x SnakeKeylogger)
ssdeep 24576:Kv9RlIGtBq/yDiQhU4V5/2rMIx2n+tEXrWOeR+Q6v+9:K1RlLt86OoL5gMrXrWOe4Qe+
Threatray 420 similar samples on MalwareBazaar
TLSH 3D15F19C7690B5DFC817C936DAA86C24EB61B4BB431BD343A45312AC9A0D69BCF105F3
Reporter sergedroz
Tags:MassLogger

Intelligence

File Origin
# of uploads :
1
# of downloads :
76
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.WBA.1477.UNOFFICIAL
Create hunting rule

Result
Threat name:
MassLogger RAT
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/362125
Behaviour
Behavior Graph:
n/a
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-26 08:37:08 UTC
File Type:
PE (.Net Exe)
Extracted files:
7
AV detection:
20 of 31 (64.52%)
Threat level:
  2/5
Verdict:
malicious
Similar samples:
3d379eee65882271295835328b7de823506975f6bce91735577a759ceff14f11
MassLogger
47799b4853ffa2cb541f153f0b50fc335324a5964e04093a8316d4a62eacc8f1
MassLogger
5756414989427044652d411548d7523b88c74449101d277d0b227a00c8526bc3
MassLogger
5c826e35fe48ce5410e9c553242a83e71b2408a57d3256bcd0bd4334412010b0
MassLogger
8a3dd3eb355760a77c7bd89e2316c7741e37f9b20435a23d144e58ba856bd7c7
MassLogger
94581916a6f0f8c4c0e9238fb1ec9ee8f44035e750f7a41115e68ebe526e6ee4
MassLogger
9c5b8535e2ac554768c5cfc3d655a3aed7647fe2280e66161a516296eb5a5918
MassLogger
c16e569fe7d77436566b268fab7037ab71efb99a5108aa452602479267508305
MassLogger
cb8c9572b8c0299b05a17084ae5dd93d0aea243138bfd03eaafaee950390724d
MassLogger
d8e9cd82c50df73b2859bb79d45585cd651783541f20badac4d9fc64aefb2820
MassLogger
+ 410 additional samples on MalwareBazaar
Result
Malware family:
masslogger
Create hunting rule
Score:
  10/10
Tags:
family:masslogger coreentity ransomware rezer0 spyware stealer
Link:
https://tria.ge/reports/201109-s3zb8e4v9a/
Behaviour
Creates scheduled task(s)
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Looks up external IP address via web service
Checks computer location settings
rezer0
CoreEntity .NET Packer
MassLogger
MassLogger log file
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:masslogger_gcch
Create hunting rule
Author:govcert_ch

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

Executable exe ae827e126c9f242564090fd5cb50ab392d61eae0f8dc1d43654bcb16aeeadc2e

(this sample)

Joe
Joe Sandbox
https://www.joesandbox.com/analysis/362125
  
Delivery method
Distributed via e-mail attachment

Comments