MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e4b1c7f2f04d674f545b52a14617dfc553b65991c4779d1b22bf41982d1201ff. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

MassLogger

Vendor detections: 5

Intelligence 5 IOCs YARA 1 File information Comments

SHA256 hash:	e4b1c7f2f04d674f545b52a14617dfc553b65991c4779d1b22bf41982d1201ff
SHA3-384 hash:	5a8185d50b5816f290f9830c28091ee7d316cbcc6101f6887b4874fc58fdd67528467e2016872ae42971add30d1c5e3e
SHA1 hash:	c9836709996845921fa247cae630087455563672
MD5 hash:	aaa7c56e1365273d298fc27167a9c2bf
humanhash:	william-quiet-blue-maryland
File name:	MkXhxWHcc49zLgc.exe
Download:	download sample
Signature	MassLogger Create hunting rule
File size:	1'165'312 bytes
First seen:	2020-07-09 07:38:16 UTC
Last seen:	2020-07-09 14:19:47 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'600 x Formbook, 12'241 x SnakeKeylogger)
ssdeep	24576:nJhMUU+xBAslhtWnRUT2W00Z4ey97uQb01Exb6mslhtWFzs:sUU+lhtWiqW00S7uqw4b2htWFg
Threatray	706 similar samples on MalwareBazaar
TLSH	6545E03B2762BE5FCA3E1DF0C05A06104FF918937295D3E8ADC250F64AD57A48F426B6
Reporter	JAMESWT_WT
Tags:	MassLogger

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Gathering data

Detection(s):

SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Launching a process

Creating a process with a hidden window

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/e4b1c7f2f04d674f545b52a14617dfc553b65991c4779d1b22bf41982d1201ff/

Threat name:

ByteCode-MSIL.Trojan.Kryptik

Status:

Malicious

First seen:

2020-07-09 01:14:21 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

24 of 29 (82.76%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=4sy4p4xqjvtu6vc3kkqumf67yvj3mwmryr3z2gzcx5azqlisah7q._file

Verdict:

unknown

MassLogger

5e89838b965d79a4782b3f1079a810f8a801c0b91e0cd71081d9580d1b954f70

MassLogger

679fa9f420878adcae22033e44afc0f0350e4463c527dd036f957fa06f0657a4

MassLogger

8459e6fc893b7dd880895eb1be14cf8a3bec6003bbb8493f819e48ba84491b87

MassLogger

8d11ba27a06091c918e76fa6d26cb14254ca651bdcfcc4efe60f99b828a29578

MassLogger

96425dbadde8f6374899265654e2e0d7e471c756c34dff01f7d5ab08cb0c6a23

MassLogger

afdef065db92bacabeb6a8b638ff1adcded1a0f578c36ac89128d13cdf701234

MassLogger

b633d14b6eb77ceeae4348f54df5f0dd430df22e5455862edd2d13bd2d53ef6b

MassLogger

e06e5ba87ec0ed09101fcd62c238777c90c6a59be6bba4ced6890250948e6a4b

MassLogger

edd4ed935c2607a173722c89b329ad9dbc39d1a6204fa8ed22987f5df7955838

MassLogger

+ 696 additional samples on MalwareBazaar

Result

Malware family:

masslogger

Score:

10/10

Tags:

spyware stealer family:masslogger

Link:

https://tria.ge/reports/200709-s5e3jf9yxs/

Behaviour

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious behavior: AddClipboardFormatListener

Creates scheduled task(s)

Suspicious use of SetThreadContext

Looks up external IP address via web service

Reads user/profile data of web browsers

MassLogger

MassLogger log file

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.