MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8727d4e86f89300972abdb0a17b9aadbe6e9053e714f1d0fe81786c3ad8a7325. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8727d4e86f89300972abdb0a17b9aadbe6e9053e714f1d0fe81786c3ad8a7325
SHA3-384 hash: 834de06323459167755790908980e4bb6d313c39c97bbc694f0adb6e394a7c07d21d72301dd6db799664e43d2a07c8fe
SHA1 hash: 512ce845ed9a5a6e47997bf086098234282c7b33
MD5 hash: f4ba31d6d139f50d40c16a67d235833e
humanhash: fifteen-sweet-blue-snake
File name:Account Inovice.rar
Download: download sample
Signature MassLogger
Create hunting rule
File size:1'119'873 bytes
First seen:2020-08-04 11:16:29 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 24576:hEZ6yqnYo5oh/zTnEjb6Hkh1AM3uIuaM0onwXhj53JhNQ+TKUW:hEZ6yqnYo5oNMGCe8RjNQ+TKB
TLSH C53533EB681CFDC7C8BC94958E47818C9014348A54BB6B7CEA7FF81D0305C7A97568BA
Reporter abuse_ch
Tags:MassLogger rar


Avatar
abuse_ch
Malspam distributing MassLogger:

HELO: s111-ir-cpanel-trade.maindns.net
Sending IP: 185.165.116.18
From: Puii Kachawuth <marketing@thaihua.com>
Reply-To: marketing@thaihua.com
Subject: Re:Payment Invoice.
Attachment: Account Inovice.rar (contains "NESC536 PO.exe")

MassLogger SMTP exfil server:
smtp.gmail.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8727d4e86f89300972abdb0a17b9aadbe6e9053e714f1d0fe81786c3ad8a7325/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-08-04 11:18:10 UTC
AV detection:
19 of 48 (39.58%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=q4t5j2dpreyas4vl3mfbponk3ptosbj6ofhr2d7ic6dmhlmkomsq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/8727d4e86f89300972abdb0a17b9aadbe6e9053e714f1d0fe81786c3ad8a7325

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

rar 8727d4e86f89300972abdb0a17b9aadbe6e9053e714f1d0fe81786c3ad8a7325

(this sample)

MassLogger

Executable exe 0785384b7bf97e6d74ac22ce8a6ba6cd629d858dd778928f6a4eac974c35cf61

  
Dropping
MD5 18de4832a189eb76e0f940fc4556390f
  
Dropping
MassLogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0785384b7bf97e6d74ac22ce8a6ba6cd629d858dd778928f6a4eac974c35cf61

Comments