MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dd0b44aeb504ee47ac61b86d092f14b7f3955b76c4b227458237acc4c9f55663. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

MassLogger

Vendor detections: 8

Intelligence 8 IOCs YARA 1 File information Comments

SHA256 hash:	dd0b44aeb504ee47ac61b86d092f14b7f3955b76c4b227458237acc4c9f55663
SHA3-384 hash:	76f5fa4ee41ff1a8e1bfec1ee3df2f2d4e130ef943c02c5979deaff8ee8a323daba65222a61a01fd7089c7a8378dfad1
SHA1 hash:	43460d683cc00525bc7c7f029917dc1248a30474
MD5 hash:	3c9af9c6d20bde870235e0ec067040b2
humanhash:	ceiling-nitrogen-hotel-steak
File name:	4QQt9AcADd7bCDK.exe
Download:	download sample
Signature	MassLogger Create hunting rule
File size:	1'382'912 bytes
First seen:	2020-07-17 05:26:50 UTC
Last seen:	2020-07-17 05:27:18 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep	24576:vrvxguwcLjrAW064eejp9XcfDi//eWNS0:jx1LIreqMfDsT
Threatray	734 similar samples on MalwareBazaar
TLSH	B7558DF7964DC2D2C59F9EBCC4924B60098BEDC1F0F8A20B1356BC7636767A0D88546B
Reporter	JAMESWT_WT
Tags:	MassLogger

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Gathering data

Detection(s):

SecuriteInfo.com.Fareit-FXH3C9AF9C6D20B.26821.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Launching a process

Creating a process with a hidden window

Result

Threat name:

MassLogger RAT

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/388912

Signature

Found malware configuration

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

May check the online IP address of the machine

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sigma detected: Scheduled temp file as task from temp location

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file access)

Uses schtasks.exe or at.exe to add and modify task schedules

Yara detected MassLogger RAT

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/dd0b44aeb504ee47ac61b86d092f14b7f3955b76c4b227458237acc4c9f55663/

Threat name:

ByteCode-MSIL.Trojan.Kryptik

Status:

Malicious

First seen:

2020-07-17 05:28:05 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

24 of 29 (82.76%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=3ufujlvvatxepldbxbwqslyuw7zzkw3wyszcormcg6wmjspvkzrq._file

Verdict:

malicious

MassLogger

1db65284dd73545215b9db3834b16709bf5bf5c33a417c38a205d09317cd6d0d

MassLogger

540a1ab8a63b1b07ea3d80939868a94dafb79f6e2fc37a8a2cc22ded21c60deb

MassLogger

750fad3db3f495fec07ac204f7e3717e75324ea9beed2fce1c48350015b888c5

MassLogger

7d3633f4d63dd8e95075561828126a43b45cd0687c7e9fd58a8e556c311f5519

MassLogger

8aef7422bb8ccc4560fb78875a0fb5d4644108a905febacd2b609012930e5744

MassLogger

8e4b63db4255d1428f0856d7e89ab1c147599416d8edd4e4e506d3f0420d77a4

MassLogger

bac48e9a9fad6c9afa0387fe592bb1eabd56cfbcbffef2bbc765e32de2846478

MassLogger

d5151bd37aa74ce1a5782e72bf26630f2df07f1e7cbeb42f45aa2f49645c35a8

MassLogger

faf1dca0b043816dc1a448c778e8fc03030add15983e04a7cc39851297615c4f

MassLogger

+ 724 additional samples on MalwareBazaar

Result

Malware family:

masslogger

Score:

10/10

Tags:

ransomware spyware stealer family:masslogger

Link:

https://tria.ge/reports/200717-r6d3q8nwv2/

Behaviour

Suspicious use of SetWindowsHookEx

Suspicious behavior: AddClipboardFormatListener

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Creates scheduled task(s)

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Looks up external IP address via web service

Reads user/profile data of web browsers

MassLogger

MassLogger log file

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Unknown

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/dd0b44aeb504ee47ac61b86d092f14b7f3955b76c4b227458237acc4c9f55663

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.