MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4df6f0119b5bca7108d167be278e7b72d295953d145e9cb9b927868a908f1275. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4df6f0119b5bca7108d167be278e7b72d295953d145e9cb9b927868a908f1275
SHA3-384 hash: 80d81dc94e09d4bcc046ca23d4cf6a97dd5fe9349f326155199af863d9d13e80f7cb3dbc5222f93aba60db1b018abc1e
SHA1 hash: 48a78b2d41d406bcbe25cabe147a42ded45d4655
MD5 hash: 75c82815ec1ee9e60d1e0505319faf47
humanhash: carolina-nuts-magnesium-vegan
File name:$24,00USD SWIFT PAYMENT FOR JUNE PDF.z
Download: download sample
Signature MassLogger
Create hunting rule
File size:1'018'277 bytes
First seen:2020-06-04 05:51:40 UTC
Last seen:2020-06-04 05:52:28 UTC
File type: zip
MIME type:application/zip
ssdeep 24576:qel6c6MLSWq+567xMy74p8D3IRIRQY5QSh9hfaIbn:vl6c72XDxMy7ACLdDCq
TLSH 5725232A317ED707EACCE5ED42644DBF8B3B4ADAD249FD5D15B04252BEC905328B04B4
Reporter cocaman
Tags:MassLogger z


Avatar
cocaman
Malicious email
From: "ACCOUNT DEPARTMENT"<apino@conectachile.cl>
Received: from server.philembassycairo.org (server.philembassycairo.org [195.154.38.153])
Date: Wed, 03 Jun 2020 21:59:28 -0700
Subject: PAYMENT SENT PLEASE CONFIRM
Attachment: $24,00USD SWIFT PAYMENT FOR JUNE PDF.z

Intelligence

File Origin
# of uploads :
2
# of downloads :
60
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Trojan.Agent-7999840-0
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Backdoor.NanoCore
Create hunting rule
Status:
Malicious
First seen:
2020-06-04 12:44:38 UTC
File Type:
Binary (Archive)
Extracted files:
20
AV detection:
26 of 48 (54.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=jx3paem3lpfhccgrm67cpdt3oljjlfj5crpjzonze6diveepcj2q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

zip 4df6f0119b5bca7108d167be278e7b72d295953d145e9cb9b927868a908f1275

(this sample)

MassLogger

Executable exe 29bf504889a98344e8f5199b18b4c86314c213de566a7671ddd55856c87c8cfb

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 29bf504889a98344e8f5199b18b4c86314c213de566a7671ddd55856c87c8cfb
  
Dropping
MassLogger

Comments