MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 43924a3ea7c1961e5e368c057f2bf1a8a877eb8d68fba15c9c5d233f1db9b5b2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 43924a3ea7c1961e5e368c057f2bf1a8a877eb8d68fba15c9c5d233f1db9b5b2
SHA3-384 hash: 1f27e2e71aa322d3b6f5809e9ccc50cd6b000093676fdc3e47cdd236a2640cc538070620eb1b9d22d54b1842226709b3
SHA1 hash: 45f52f33cee4b5c73ee0f23cd12ca5345b3bfacc
MD5 hash: c5bcc341c3f59b68aa15bfbc9e31229a
humanhash: football-vermont-sweet-low
File name:ORDER FORM.cab
Download: download sample
Signature MassLogger
Create hunting rule
File size:827'937 bytes
First seen:2020-05-27 17:58:40 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:Ggr9BfoX8r8to1X1W7HK04OxF2jwejttVh/SrTYMtxjC1qZ/D9TyZmVyVApYJ0mr:Ggr9a7vx03jj7/Src09Z/D9S6CWLFw9
TLSH 3305230E0D34FBA1BAEE591AE65D8A282C97112714B780751C3496FBD006B6D7D02FBF
Reporter abuse_ch
Tags:cab MassLogger


Avatar
abuse_ch
Malspam distributing MassLogger:

HELO: llsk281-a17.servidoresdns.net
Sending IP: 82.223.190.12
From: rugasa@rugasa.com
Subject: RE:Reference: GOT / 731104 :: Enquriy
Attachment: ORDER FORM.cab (contains "ORDER FORM.exe")

MassLogger SMTP exfil server:
smtp.gmail.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Crysan
Create hunting rule
Status:
Malicious
First seen:
2020-05-28 03:58:01 UTC
AV detection:
15 of 48 (31.25%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

rar 43924a3ea7c1961e5e368c057f2bf1a8a877eb8d68fba15c9c5d233f1db9b5b2

(this sample)

MassLogger

Executable exe 8b21c06bf03c5f788bb0354c625f343873bc834ac43b1d8fbc469fd64f215cf6

  
Dropping
MD5 0faa3c5a42f64964e82ce6a1c46bd9f1
  
Dropping
MassLogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8b21c06bf03c5f788bb0354c625f343873bc834ac43b1d8fbc469fd64f215cf6

Comments