MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 44e6bcfc3f0af959f8ad204d3682c688ee2dabbb156ec89e49b0c8b061363acd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 44e6bcfc3f0af959f8ad204d3682c688ee2dabbb156ec89e49b0c8b061363acd
SHA3-384 hash: a6dd95d1773364d736cc5ae8e6fdea16d6a1ced702aead21b09cc5313e06b1c5c6966c4b052bdb41bba6c8833ae51275
SHA1 hash: 4285c4d27f38c2bd6a8b3ab38f168d38b1ada8b8
MD5 hash: d79790ae6cbfe0b62d8c48fc7cb66ab1
humanhash: lemon-seven-zebra-carolina
File name:HSBC SWIFT- Advice Ref Aug 31 2020 at 1.80_145210_PDF.img
Download: download sample
Signature MassLogger
Create hunting rule
File size:1'966'080 bytes
First seen:2020-08-31 11:16:58 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 24576:GkWa7T1R/gheYuwAN6v/6GFsaNuzo9YqnJ2mKcBzcgrs8n68ac:GaX/AeXwANGaacUSqJIctcks4689
TLSH 3B95F113531E9B2ED8187679358000DCE2F16F86FB38E1D9FD4B31E9696660DA1ED282
Reporter abuse_ch
Tags:HSBC img MassLogger


Avatar
abuse_ch
Malspam distributing MassLogger:

HELO: vps13983.ervers.com
Sending IP: 185.136.91.180
From: HSBC Bank <chrismachon@hsbc.com>
Subject: RE: HSBC SWIFT - Advice Ref: [ORI123456] /Customer Ref:[028218]
Attachment: HSBC SWIFT- Advice Ref Aug 31 2020 at 1.80_145210_PDF.img (contains "HSBC SWIFT- Advice Ref Aug 31 2020 at 1.80_145210_PDF.exe")

MassLogger SMTP exfil server:
mail.copyrap.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
76
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Generic.mg.d1b2d539c4e64dae.25724.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/44e6bcfc3f0af959f8ad204d3682c688ee2dabbb156ec89e49b0c8b061363acd/
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ittlz7b7bl4vt6fnebgtnawgrdxc3k53cvxmrhsjwdelayjwhlgq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/44e6bcfc3f0af959f8ad204d3682c688ee2dabbb156ec89e49b0c8b061363acd

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

img 44e6bcfc3f0af959f8ad204d3682c688ee2dabbb156ec89e49b0c8b061363acd

(this sample)

MassLogger

Executable exe 13af67261cdde6647fc4c1669ced247f69a2e03b08e62dfea53a3af3d4a867da

  
Dropping
MD5 d1b2d539c4e64daed977e74f059d69ff
  
Dropping
MassLogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 13af67261cdde6647fc4c1669ced247f69a2e03b08e62dfea53a3af3d4a867da

Comments