MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cc6b0848a3a848c9ee7ce3f63d1e3f95393f6593140e2aab400146c06e593793. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

MassLogger

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	cc6b0848a3a848c9ee7ce3f63d1e3f95393f6593140e2aab400146c06e593793
SHA3-384 hash:	534f531f9c951fea9ce1c9d5f026ac090104e16363adcb3d14acef2e7efe4ac91acced2218081535339f00fd6677e675
SHA1 hash:	e457ae2ad469dd932300a02a4e3b9c03010d5e31
MD5 hash:	f8d0bab3e3367fbd94c1f82eb33714e7
humanhash:	july-autumn-johnny-glucose
File name:	img_0933.exe
Download:	download sample
Signature	MassLogger Create hunting rule
File size:	1'421'824 bytes
First seen:	2020-07-13 11:41:23 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'599 x Formbook, 12'241 x SnakeKeylogger)
ssdeep	12288:OTuZ7ESGL8dretAMqxyDPk5eA/G23vFbGirfnm1L0y2GalXtIpf79fN5r:XRESGYdrzacecG2vFb5nlvG4IBx
Threatray	996 similar samples on MalwareBazaar
TLSH	B765293976928418C4694776C4B4DCE1B7627E8A3752C70F30CB1B4E7E07A9FBB4A05A
Reporter	abuse_ch
Tags:	exe MassLogger

abuse_ch

Malspam distributing MassLogger:

HELO: minmaxbd.net
Sending IP: 45.138.172.46
From: KHAN <bd@minmaxbd.net>
Reply-To: KHAN <bd@minmaxbd.net>
Subject: Re: New BL draft (URGENT)
Attachment: img_0933.r00 (contains "img_0933.exe")

MassLogger SMTP exfil server:
mail.aydan.com.tr:587

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Gathering data

Detection(s):

SecuriteInfo.com.MSIL.Kryptik.WUR.9748.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Creating a file in the %temp% directory

Running batch commands

Launching a process

Creating a file

Creating a process from a recently created file

Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/cc6b0848a3a848c9ee7ce3f63d1e3f95393f6593140e2aab400146c06e593793/

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2020-07-13 10:41:21 UTC

AV detection:

22 of 29 (75.86%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=zrvqqsfdvbemt3t44p3d2hr7su4t6zmtcqhcvk2aafdma3szg6jq._file

Verdict:

unknown

MassLogger

12196207ffedfa2675b71f8c086df39c8ae73eb0fb2909674044ec3a45772d6b

MassLogger

434b95216fefcfdef179cbafe780e88243b818bce4ab11b88863bedc4a9cc0d0

MassLogger

45e3a9f28c7e79a55264a5c88490dfe51a73639eac96e29f724bdc96232e341b

MassLogger

69842a6dc654dfc2d3a69b566e90679318cbac7209d4286df9af58b8e173ab90

MassLogger

89b4121aae370dd8b644fc0e426e24d17087b25e1646aaf02e56b147627efd16

MassLogger

9343011118ad09e9a63a24adb5cc08f406ffc927230b1be998cb263ebf23eedd

MassLogger

b7c38b8ca8e90da906c7df9ea379e0c9386780ee32b174cd1f82cd8662822efc

MassLogger

d251c653db7e7df1e0d7858d8e1870055a5ccdd5749295c1a41a1e47f2a3c109

MassLogger

f27eb43c59ea9a9f7ffc4e9bb14e67fd1667825c0e8851d4a1abb9441180076a

MassLogger

+ 986 additional samples on MalwareBazaar

Result

Malware family:

masslogger

Score:

10/10

Tags:

persistence spyware stealer family:masslogger

Link:

https://tria.ge/reports/200713-yzlhw9cd9a/

Behaviour

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Looks up external IP address via web service

Adds Run entry to start application

Loads dropped DLL

Reads user/profile data of web browsers

Executes dropped EXE

MassLogger log file

MassLogger

Malware family:

MassLogger

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/cc6b0848a3a8/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.