MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 d42e838fc8e2a07efdeb9ee11c8078d86ce797de599c633251927f6a24d7dea5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
MassLogger
Vendor detections: 7
| SHA256 hash: | d42e838fc8e2a07efdeb9ee11c8078d86ce797de599c633251927f6a24d7dea5 |
|---|---|
| SHA3-384 hash: | aa54826410cc4bc30a958bfd5aa615faa461d13fc8f34a087d9ac7cf6916e75b987ef058ac46ce8d7c7b487f3c3ced23 |
| SHA1 hash: | af5f73299242b5509c94a6c3daf3e8eed75dd2fe |
| MD5 hash: | f0e7185846d5e2918816fd651e9f178b |
| humanhash: | alanine-golf-green-hot |
| File name: | FV00620224400 009384766589 6645.exe |
| Download: | download sample |
| Signature | MassLogger |
| File size: | 16'896 bytes |
| First seen: | 2020-08-13 11:08:30 UTC |
| Last seen: | 2020-08-13 12:24:47 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'743 x AgentTesla, 19'608 x Formbook, 12'242 x SnakeKeylogger) |
| ssdeep | 384:1HFC1ehNsVKAna6NvRAI0pJbD27jyHptYcF0Kc03K:5hL0aYAI0pJbD27jyJtYcF0Kc6K |
| Threatray | 520 similar samples on MalwareBazaar |
| TLSH | 1B72823D2AA4F133C535C6B30993A251FA348907B4836F2930CDD61BBF5A99477C3A69 |
| Reporter |  abuse_ch |
| Tags: | DHL exe MassLogger |
abuse_ch
Malspam distributing unidentified malware:From: "DHL Customer Support" <luis_manzano_dhl@gmail.com>
Subject: DHL Failed Shipment Notification:6174333620
Attachment: FV00620224400 009384766589 6645.r00 (contains "FV00620224400 009384766589 6645.exe")
Intelligence
File Origin
# of uploads :
2
# of downloads :
71
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Result
Verdict:
Suspicious
Maliciousness:
Behaviour
Launching a process
Creating a process with a hidden window
Creating a file
Using the Windows Management Instrumentation requests
DNS request
Sending an HTTP GET request
Sending a UDP request
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
48 / 100
Signature
Bypasses PowerShell execution policy
Machine Learning detection for sample
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.AgentTesla
Status:
Malicious
First seen:
2020-08-13 11:10:08 UTC
AV detection:
20 of 29 (68.97%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
suspicious
Similar samples:
+ 510 additional samples on MalwareBazaar
Result
Malware family:
masslogger
Score:
10/10
Tags:
ransomware spyware stealer family:masslogger
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Looks up external IP address via web service
Reads user/profile data of web browsers
Blacklisted process makes network request
MassLogger log file
MassLogger
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.