MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f338a1b80c46346c5e3d7576b4726faf90a477c396f424aa1325b8cc03ae9a30. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

MassLogger

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	f338a1b80c46346c5e3d7576b4726faf90a477c396f424aa1325b8cc03ae9a30
SHA3-384 hash:	74ad15f4cec3261a5aa1179b09607562821acf3ef75d2a1e9bb7d2de3a120fddcb633a04cb6a025d8fdd131a504c4ee2
SHA1 hash:	4c4cc099c3e32ae9e6324e723392c9fc56332800
MD5 hash:	179da9d044907a92d189b869932bfcdf
humanhash:	saturn-iowa-juliet-finch
File name:	EIC.exe
Download:	download sample
Signature	MassLogger Create hunting rule
File size:	1'171'456 bytes
First seen:	2020-07-13 15:50:50 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	2a2488d4e6117f1c1c09ec31ad2be7a6 (9 x AgentTesla, 6 x MassLogger, 1 x FormBook)
ssdeep	24576:YivyudcBzOliBaw2xw6/czpj8b16S8zJDsPCx8shqll:YIs2czpjTS8zJ+5xr
Threatray	2'123 similar samples on MalwareBazaar
TLSH	7645BE22F2914437C5722A3C9D5B93645D2AFE11EE38E94A2BF45C8C4F7D68138392E7
Reporter	JAMESWT_WT
Tags:	MassLogger

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/25469/

Detection(s):

SecuriteInfo.com.Adware.Generic4.BBFB.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Unauthorized injection to a recently created process

Launching a process

Using the Windows Management Instrumentation requests

Creating a file

Reading Telegram data

Reading critical registry keys

Moving a recently created file

Deleting a recently created file

Setting a global event handler for the keyboard

Unauthorized injection to a system process

Enabling autorun with Startup directory

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f338a1b80c46346c5e3d7576b4726faf90a477c396f424aa1325b8cc03ae9a30/

Threat name:

Win32.Infostealer.Fareit

Status:

Malicious

First seen:

2020-07-13 15:38:54 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

26 of 29 (89.66%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=6m4kdoamiy2gyxr5ov3li4tpv6iki56ds32cjkqtew4mya5otiya._file

Verdict:

malicious

Label(s):

hawkeyekeylogger

MassLogger

5caf50c8907738643bd5648927c52306bf9177cb178065d1ee08590a0d37f0c9

MassLogger

733841eb6bd45f7099e486392dec943d82d2c80167bdc831c2041f7a8dfdaa1c

MassLogger

8799e5ea88300796b9a0ff95668c81998e3805d1844325931b25183d8385560c

MassLogger

921f5424e5b5ece1bbf1bb40d86344993ec28ea7f75d2889edd60a906bfef685

MassLogger

c627c5c10fd7f312faa0a63be604af144644962b478c7d1457974548254a9cd2

MassLogger

cfa043d2f0aaec78a984700f442b041a62f06e569813c105a98765a9a0375f58

MassLogger

f38c7008dfa86d68f06b6569b3e7f4c1907dc5a8cfc5404c5d40087622e30494

MassLogger

f7a054a2651fe89cdb48c590a10eff889b09511e408e1bc16d04e07b437b1955

MassLogger

fa28b1a6ff3b10c3fd15538fa05946b6864a49acead10738a0b6bdb44da64816

MassLogger

+ 2'113 additional samples on MalwareBazaar

Result

Malware family:

masslogger

Score:

10/10

Tags:

spyware stealer family:masslogger

Link:

https://tria.ge/reports/200713-2zyprqblgj/

Behaviour

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Suspicious behavior: AddClipboardFormatListener

Suspicious use of SetThreadContext

Looks up external IP address via web service

Reads user/profile data of web browsers

Drops startup file

UPX packed file

MassLogger log file

MassLogger

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.