MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f9aa404e6b892570fa59a968eb1e6f2069cb6e6105632e323ae91d7c8005fe57. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


M00nD3v


Vendor detections: 6


Intelligence 6 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f9aa404e6b892570fa59a968eb1e6f2069cb6e6105632e323ae91d7c8005fe57
SHA3-384 hash: f5172ce0ba67edc6e28f6630fe55104f97ee403d5325ab21fcaacdfbf7eee3211ed84ab803de61030000cc8c58f9e74c
SHA1 hash: 9f4706d84e0d13eba62c2df75076905817049d84
MD5 hash: 196a1e8555f3dd52a909c8e203256b6f
humanhash: vegan-table-sweet-north
File name:196a1e8555f3dd52a909c8e203256b6f.exe
Download: download sample
Signature M00nD3v
Create hunting rule
File size:410'624 bytes
First seen:2020-06-08 16:36:21 UTC
Last seen:2020-06-08 18:18:44 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'452 x Formbook, 12'202 x SnakeKeylogger)
ssdeep 6144:Be1jZQBJKKEO0bJrdwE5XGm8sM7xr0wTRyiV6T8R7qvIHe9Xych2N+Yd83sov0l:BexO4ZT8hxr0eRyHKq2mENV3oo
Threatray 513 similar samples on MalwareBazaar
TLSH D294121073D94737CE7E87FC91A5A000A3757506A72DFB0E1ECE31EB0EA1B254A91A5B
Reporter abuse_ch
Tags:exe M00nD3v


Avatar
abuse_ch
M00nD3v SMTP exfil server:
mail.privateemail.com:587

Intelligence

File Origin
# of uploads :
3
# of downloads :
82
Origin country :
n/a
Vendor Threat Intelligence
Detection:
M00nD3v
Create hunting rule
Link:
https://www.capesandbox.com/analysis/7114/
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.WFS.2317.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-08 16:38:05 UTC
File Type:
PE (.Net Exe)
Extracted files:
9
AV detection:
25 of 31 (80.65%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=7gveattlresxb6szvfuowhtpebu4w3tbavrs4mr25eoxzaaf7zlq._file
Verdict:
malicious
Label(s):
hawkeyekeylogger
Create hunting rule
emotet
Create hunting rule
Similar samples:
0a375c52851b79c5d3be0d18025940bee5f68501c8e18334264f116775e57fa7
M00nD3v
0b0843fec59e2e7c90b04d88f9d90f7e6a3c8e7511a601d20ba588a52380781b
M00nD3v
1136fada0e7737d8ea5304cb8e85550cf1ca35e2b64bfa6e000b07d5c428f7d7
M00nD3v
3a2adcac20af82cdb882ab9bd9a1a78ca30f833a488cd13a55daf8ff743271a3
M00nD3v
400ad786bf1e76812b70a3ab4ba345668fe07c176743f412f6ff5372238c2320
M00nD3v
538a207974969d50055870c016eb819c2a71a1388db863bf025ea5bc2144b00b
M00nD3v
a4b07204b33173093041072e00e88d0083c88b88f634561aabe46ec8992f9332
M00nD3v
c0a5e2237ef1901c7a3ee2c15290c8db625a1cb9659e99a86ee474460533aa32
M00nD3v
c51d3c8be3936b476ac729e5ddc15eb4dcd5dea18dbcf8200f0767b33ab0b076
M00nD3v
c730e6287aa786e04d22daa4e6c77b504cdf80dc4f09877a15bc79bac84403f6
M00nD3v
+ 503 additional samples on MalwareBazaar
Result
Malware family:
m00nd3v_logger
Create hunting rule
Score:
  10/10
Tags:
family:m00nd3v_logger rezer0 spyware stealer
Link:
https://tria.ge/reports/201109-yqpdg1xxrs/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Looks up external IP address via web service
Reads user/profile data of web browsers
Uses the VBS compiler for execution
M00nD3v Logger Payload
ServiceHost packer
rezer0
M00nd3v_Logger
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:APT_NK_BabyShark_KimJoingRAT_Apr19_1
Create hunting rule
Author:Florian Roth
Description:Detects BabyShark KimJongRAT
Reference:https://unit42.paloaltonetworks.com/babyshark-malware-part-two-attacks-continue-using-kimjongrat-and-pcrat/
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:win_m00nd3v_j1
Create hunting rule
Author:Johannes Bader @viql
Description:detects the M00nD3v keylogger

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

M00nD3v

Executable exe f9aa404e6b892570fa59a968eb1e6f2069cb6e6105632e323ae91d7c8005fe57

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/383455/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/7114/

Comments