MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5a7b4a2c621603832c1e73ad6d7ad022c260daaca1ea193a5e0ecca3bc5609d3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5a7b4a2c621603832c1e73ad6d7ad022c260daaca1ea193a5e0ecca3bc5609d3
SHA3-384 hash: cc5ee64edb64faed2173c3ae81920de9c0218673d3cf1ed997e8b7042b9d8b8c99c608f168f6d6ca7308ed52c2356099
SHA1 hash: 1e8dadc474ea6fc886da9cae927a9d1659934fba
MD5 hash: 296b8ac7f5bc9ef7c433c02aa5385d79
humanhash: princess-arkansas-romeo-avocado
File name:BL_0003.zip
Download: download sample
Signature MassLogger
Create hunting rule
File size:791'279 bytes
First seen:2020-08-05 09:21:59 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:tFw3Md/bYNpxsVfuH5CvQr4zxQVBTvrE7gaz3MBb5WbkDRMxNsunUHS:s30/c7xscZNBvrCgaz3E5/uAly
TLSH E5F423E223E643B0B9376C49FBD24DC91444F855A2F9AEAC5DC4567C08F04F40AEB79A
Reporter abuse_ch
Tags:MassLogger zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: san-hong.com.cn
Sending IP: 103.99.1.147
From: 庄晓丽 <amily@san-hong.com.cn>
Subject: Draft Bill of Lading
Attachment: BL_0003.zip (contains "BL_0003.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
58
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5a7b4a2c621603832c1e73ad6d7ad022c260daaca1ea193a5e0ecca3bc5609d3/
Threat name:
ByteCode-MSIL.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2020-08-05 09:23:11 UTC
AV detection:
20 of 29 (68.97%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=lj5uuldccybygla6ooww26wqelbgbwvmuhvbsos6b3gkhpcwbhjq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5a7b4a2c621603832c1e73ad6d7ad022c260daaca1ea193a5e0ecca3bc5609d3

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

zip 5a7b4a2c621603832c1e73ad6d7ad022c260daaca1ea193a5e0ecca3bc5609d3

(this sample)

MassLogger

Executable exe eb3d6a6bfec90855240b6e239a10d283ecf13b118e9b769e2f4100b3eec76a12

  
Dropping
MD5 e62ddd8facfe9707b2f56fd60bb09266
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 eb3d6a6bfec90855240b6e239a10d283ecf13b118e9b769e2f4100b3eec76a12

Comments