MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6bb4e6826252ce5e4606793d3e309be17b20786eccb0b471713312513ffb4e12. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6bb4e6826252ce5e4606793d3e309be17b20786eccb0b471713312513ffb4e12
SHA3-384 hash: 944a28a426981dc1568ec882b055e6ef0cf0f7c6fff23f03c8829c8f67c0800289df4f5a4709832ba2c76e4a055e13ec
SHA1 hash: 3c69db28e433adef24cf834bfa27a6929b5a1f4b
MD5 hash: 192aadf951d7a7c4abf5b9fabd3ccce2
humanhash: bulldog-kentucky-white-network
File name:COMPROBANTE DE PAGO.pdf.gz
Download: download sample
Signature MassLogger
Create hunting rule
File size:898'215 bytes
First seen:2020-08-05 16:16:14 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 24576:AkWplB92yoJeD4bwurA0zfdC5YqSGHXr/RNhE8f6:AxJUe4bJrjpn5uLBPf6
TLSH ED15331B8196AE66D0F4C2D7BBC02CE6EE05CE4B99D2510E386593B8C33FB4815C59B6
Reporter abuse_ch
Tags:gz MassLogger


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: gasteev.com
Sending IP: 37.49.224.121
From: Noemi Sanchez <info@gasteev.com>
Subject: RV: Operacion transaccional AfirmeNet
Attachment: COMPROBANTE DE PAGO.pdf.gz (contains "COMPROBANTE DE PAGO.pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
78
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Mal.DrodGzip-A.7263.11427.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6bb4e6826252ce5e4606793d3e309be17b20786eccb0b471713312513ffb4e12/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-08-05 16:18:06 UTC
AV detection:
19 of 48 (39.58%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=no2onatcklhf4rqgpe6t4me34f5sa6dozsyli4lrgmjfcp73jyja._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.45
Link:
https://yomi.yoroi.company/submissions/6bb4e6826252ce5e4606793d3e309be17b20786eccb0b471713312513ffb4e12

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

gz 6bb4e6826252ce5e4606793d3e309be17b20786eccb0b471713312513ffb4e12

(this sample)

MassLogger

Executable exe 3ae1d5294542b34ed3a65d9b467d07a50146e561193e5923dd37dc3abcf81a57

  
Dropping
MD5 f384c02a9e5e35ac22c070c537742f0d
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3ae1d5294542b34ed3a65d9b467d07a50146e561193e5923dd37dc3abcf81a57

Comments