MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c16e569fe7d77436566b268fab7037ab71efb99a5108aa452602479267508305. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 3


Intelligence 3 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c16e569fe7d77436566b268fab7037ab71efb99a5108aa452602479267508305
SHA3-384 hash: 8102eb0790783358877148bc1c099716907f767a11186da533418fa6681740b9366c2d35ba0a894b45e9bc6c8ac314b6
SHA1 hash: 491af4a7b6cd0f88e29db4a8baedd3dee6561920
MD5 hash: 29543329d1136c252bed354e788352f6
humanhash: berlin-stairway-asparagus-equal
File name:QUOTATION.exe
Download: download sample
Signature MassLogger
Create hunting rule
File size:751'616 bytes
First seen:2020-05-27 11:16:57 UTC
Last seen:2020-05-27 11:48:09 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'474 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:DWbvAc4vgjyafTY/fYccJozXhUVzxLQdpkeTgui3nUY1SorXXK3+69jaztmTrPe:DWbvMufTY3YrECHLiu3nUY1SUX6OMZTC
Threatray 464 similar samples on MalwareBazaar
TLSH 80F4124026F9575AFBFB8F70E7F072A5CBBAA5B5251BF268484106C35761B804922F33
Reporter jarumlus
Tags:MassLogger

Intelligence

File Origin
# of uploads :
2
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Mal.Generic-S.28265.22041.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Genkryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-27 06:47:56 UTC
File Type:
PE (.Net Exe)
Extracted files:
8
AV detection:
22 of 31 (70.97%)
Threat level:
  2/5
Verdict:
malicious
Similar samples:
29f20793c95925c35611390902e709a7e12562afe8b3c7298c911e5dd9871526
MassLogger
343873155b6950386f7d9bcd8d2b2e81088521aedf8ff1333d20229426d8145c
MassLogger
3d379eee65882271295835328b7de823506975f6bce91735577a759ceff14f11
MassLogger
49ced6e317fa96af1310ad10e5b71fea0d84e03b42ff0434f11d312ebb62dbcf
MassLogger
8bc95f1ba65bf54858a20c62bf09e9e39027f8be74369c25401b5e4503b1b553
MassLogger
a2a4fc12990dcf4a9778f96840b49be84f9563edd2b5209b6dac1ffb2ed8e38d
MassLogger
a760f527a357c0102eb9d9ecc6ca76f245d34237b230ce9a38e83ae806ab13cb
MassLogger
cac67b5ab04de81f69b8f4f882ad22e26672a61ed96d2e1f69d72f59c36bf401
MassLogger
dc6eb4d716d3a1c045090d38abe87f80e14ab2bbb997268a2190332fb7563dcb
MassLogger
f937bbe27c6d52452a121bc9aa320c26ae7eada7cadc9dda0fafc2c6b1bd5818
MassLogger
+ 454 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  9/10
Tags:
evasion
Link:
https://tria.ge/reports/201109-f2c2sfrlw2/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Maps connected drives based on registry
Checks BIOS information in registry
Looks for VMWare Tools registry key
Looks for VirtualBox Guest Additions in registry
ServiceHost packer
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:masslogger_gcch
Create hunting rule
Author:govcert_ch

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

Executable exe c16e569fe7d77436566b268fab7037ab71efb99a5108aa452602479267508305

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments