MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e7acb91c1fe721b5a2cb5dcae27e69d1ce575cf19a0d929fe6b6ff9b81ebdf9b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Intelligence File information Yara 1 Comments

SHA256 hash: e7acb91c1fe721b5a2cb5dcae27e69d1ce575cf19a0d929fe6b6ff9b81ebdf9b
SHA3-384 hash: 6e6a9282960d7cd6664be50cb04765a978c11ef3de26d0c4eb5709c45b01aa674b9c4ca2c908da341adc4fd7fd945434
SHA1 hash: a0e184e3f49bc7ea55d19b3ad698cb12fe05f517
MD5 hash: c55134b50627719ad8526757721e3146
humanhash: mango-ten-pennsylvania-bravo
File name:Purchase order from Innovix Distribution_pdf.exe
Download: download sample
Signature MassLogger
File size:1'092'608 bytes
First seen:2020-06-29 12:33:44 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744
ssdeep 12288:3rs1WBsejpS7oTO5VeoCAsww55S+U96pKHt0BZL3kTGP2NG7J2z8u:A1WjpS7oa5VDC5ww5k+NS2L2NgQz8u
TLSH E7356C403FB09C13E89A01B054147E8B1D7DA943E4D5E26BBB723AD165729BFE5B8C0E
Reporter @abuse_ch
Tags:exe MassLogger


Twitter
@abuse_ch
Malspam distributing MassLogger:

HELO: slot0.meplesci.com
Sending IP: 45.95.169.70
From: ''Eric Wang''<info@meplesci.com>
Reply-To: info@meplesci.com
Subject: REQUEST FOR QUOTATION - NO: 792-286
Attachment: Purchase order from Innovix Distribution_pdf.rar (contains "Purchase order from Innovix Distribution_pdf.exe")

MassLogger SMTP exfil server:
mail.mytravelexplorer.com:587

Intelligence


File Origin
# of uploads :
1
# of downloads :
30
Origin country :
US US
Mail intelligence
Geo location:
Global
Volume:
Low
Vendor Threat Intelligence
Threat name:
Win32.Trojan.Kryptik
Status:
Malicious
First seen:
2020-06-29 12:35:09 UTC
AV detection:
24 of 31 (77.42%)
Threat level
  5/5
Result
Malware family:
masslogger
Score:
  10/10
Tags:
ransomware spyware stealer family:masslogger
Behaviour
Suspicious behavior: AddClipboardFormatListener
Creates scheduled task(s)
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Suspicious use of SetThreadContext
Looks up external IP address via web service
Reads user/profile data of web browsers
MassLogger
MassLogger log file

Yara Signatures


Rule name:masslogger_gcch
Author:govcert_ch

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

Executable exe e7acb91c1fe721b5a2cb5dcae27e69d1ce575cf19a0d929fe6b6ff9b81ebdf9b

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments