MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d0f1b190868c2b25c602e6eee551a39fe677678d6e7dc45eb304fa82a5760799. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 8


Intelligence 8 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d0f1b190868c2b25c602e6eee551a39fe677678d6e7dc45eb304fa82a5760799
SHA3-384 hash: d276d7da80aa012a101ce0084baab355ed9f41bacada2f0c5174caf95f094e69f5232c7ed65dfabac3196b26320444a2
SHA1 hash: a432474f6c65cec9343c540aa10fb313d6eb112a
MD5 hash: f4201dd98773cac936bc187ea40fe7ed
humanhash: alpha-fillet-west-mango
File name:CDC COVID-19 Second Outbreak Warning release.exe
Download: download sample
Signature MassLogger
Create hunting rule
File size:1'002'816 bytes
First seen:2020-11-17 07:05:47 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'474 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 24576:+Og1X8usveLnwU2aLlHuQwcH1lf8T17ENlBAJXA/:+OgqbveLnw5YBuv84MlBAJXA/
Threatray 524 similar samples on MalwareBazaar
TLSH 5C25231E9B45D513F79A5FBA8EE2E6B047FD88C47FC5D312504A022309933E52C8E99B
Reporter Anonymous
Tags:MassLogger

Intelligence

File Origin
# of uploads :
1
# of downloads :
118
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Generic.mg.f4201dd98773cac9.5082.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Using the Windows Management Instrumentation requests
Creating a file in the %AppData% subdirectories
Unauthorized injection to a recently created process
Creating a file
Launching the default Windows debugger (dwwin.exe)
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Result
Gathering data
Result
Threat name:
MassLogger RAT
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/539040
Signature
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected Costura Assembly Loader
Yara detected MassLogger RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 318615 Sample: CDC COVID-19 Second Outbrea... Startdate: 17/11/2020 Architecture: WINDOWS Score: 76 35 Malicious sample detected (through community Yara rule) 2->35 37 Yara detected MassLogger RAT 2->37 39 Machine Learning detection for sample 2->39 41 3 other signatures 2->41 7 CDC COVID-19 Second Outbreak Warning release.exe 1 4 2->7         started        11 winrar.exe 2->11         started        13 winrar.exe 1 2->13         started        process3 file4 29 C:\Users\user\AppData\Roaming\...\winrar.exe, PE32 7->29 dropped 31 C:\Users\user\...\winrar.exe:Zone.Identifier, ASCII 7->31 dropped 33 CDC COVID-19 Secon...ing release.exe.log, ASCII 7->33 dropped 43 Injects a PE file into a foreign processes 7->43 15 CDC COVID-19 Second Outbreak Warning release.exe 2 7->15         started        17 winrar.exe 2 11->17         started        19 winrar.exe 11->19         started        21 winrar.exe 2 13->21         started        signatures5 process6 process7 23 WerFault.exe 23 9 15->23         started        25 WerFault.exe 17->25         started        27 WerFault.exe 19 9 21->27         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d0f1b190868c2b25c602e6eee551a39fe677678d6e7dc45eb304fa82a5760799/
Threat name:
ByteCode-MSIL.Trojan.SmartAssembly
Create hunting rule
Status:
Malicious
First seen:
2020-11-17 05:18:01 UTC
AV detection:
20 of 28 (71.43%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2dy3deegrqvslrqc43xokundt7thoz4nnz64ixvtat5ifjlwa6mq._file
Verdict:
malicious
Label(s):
masslogger
Create hunting rule
Similar samples:
061e4c2aaf9eb384ce88acacafa133185ede67c01c1ad01d1949218e04901c6b
MassLogger
0a64f93aa274c2da0f686f8ad410699495d1aa8b68efbd5829e95cb226cc97ee
MassLogger
0d6f912181bf01b2197d8501f5b38f6c009c6c4a4e76fa6e0b3d2d4efe05bfbb
MassLogger
2fea8f7c727460dfd943dce7f9bb051f188f37a0150a132039a1892f18749ff3
MassLogger
6030faadae8d2aa1b94b06da9c0d4ed3ce33076a1bc04218027519b1043a6a95
MassLogger
70caf501b061da2729d33d4b0c5e9b9c58bc554cdbdddef16f7e057ea346808c
MassLogger
9bf180bb7b3cc0fcc6d01b68e2aa82d2f853e081ec71e34942d875324a2415b4
MassLogger
a2b0e9c1ea03a3a538fe9ef7f8e6dbf4c08feba8560e238e29fce0dd2f2e144b
MassLogger
a558950f60aa2a7e34ac71c8a3013fbf576f485a9468ecfe5fdb0a1abb2cafbe
MassLogger
ce073fce9de335c288fe205d5bf7fbdd9fd3ecc718821116dbad098f176a69de
MassLogger
+ 514 additional samples on MalwareBazaar
Result
Malware family:
masslogger
Create hunting rule
Score:
  10/10
Tags:
family:masslogger persistence spyware stealer
Link:
https://tria.ge/reports/201117-qnsay13cdn/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of SetThreadContext
Adds Run key to start application
ServiceHost packer
MassLogger
MassLogger Main Payload
Unpacked files
SH256 hash:
951c47007e591ccb3bfd5e7c7a9b411138b3604105cc386570cfb11d3f6e49dd
MD5 hash:
dce4a444c197f4e02b2f673a96a8d680
SHA1 hash:
55213b180c8135518dddf3a755d72031cfb03839
Link:
https://www.unpac.me/results/e61cf68e-9338-42a7-bcd2-e59058e570fb/
SH256 hash:
83c08f0721c8b0c96e3d6a8f3ccaf5c96fbcc427d574625c34424c3429fefaa1
MD5 hash:
3c5dbcc3bb27e913e14efd8054811373
SHA1 hash:
b0eba9388abddaef9d5aa49ccd5dbab2924cced0
Link:
https://www.unpac.me/results/e61cf68e-9338-42a7-bcd2-e59058e570fb/
SH256 hash:
a635fa6763311c7cb360f61f24ed31c697568fc7765434ea0c286bf162680400
MD5 hash:
bb2c8d2651a62ec090b2a662562f625c
SHA1 hash:
da67c9eebf43dd68b2eb61e563773ac453490192
Detections:
win_masslogger_w0
Create hunting rule
Link:
https://www.unpac.me/results/e61cf68e-9338-42a7-bcd2-e59058e570fb/
SH256 hash:
d0f1b190868c2b25c602e6eee551a39fe677678d6e7dc45eb304fa82a5760799
MD5 hash:
f4201dd98773cac936bc187ea40fe7ed
SHA1 hash:
a432474f6c65cec9343c540aa10fb313d6eb112a
Link:
https://www.unpac.me/results/e61cf68e-9338-42a7-bcd2-e59058e570fb/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Keylog_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Contains Keylog
Rule name:masslogger_gcch
Create hunting rule
Author:govcert_ch
Rule name:Quasar_RAT_1
Create hunting rule
Author:Florian Roth
Description:Detects Quasar RAT
Reference:https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf
Rule name:win_masslogger_w0
Create hunting rule
Author:govcert_ch

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments