MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 945de800ae672cc44cca74776ec9b3658aaa8dd14d6fef5643f6641a618a92e4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 945de800ae672cc44cca74776ec9b3658aaa8dd14d6fef5643f6641a618a92e4
SHA3-384 hash: 49507810663ea01fd1306256340436cd0fb145bcf1a1eb6e2f420038cb0476b43ccfd969e194253238bd94408cbd1ab9
SHA1 hash: a102589d8545b44d1cc1504b17c077d6dc52b65b
MD5 hash: 571f3113c938be5a96aed8f2ff16427d
humanhash: ack-white-uniform-green
File name:Order Inquiry with Design Samples.zip
Download: download sample
Signature MassLogger
Create hunting rule
File size:874'678 bytes
First seen:2020-08-06 05:34:39 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:NK9f0KjLmy5wtBmoi9egaGHJ9vKUi7Ewke9a+:NKxvLmyzfr9v6jv
TLSH 5A15331A1239396DAD5CC7A42CEDB6F2EFD960D03601593DD23A6EFE2DA64C150600EF
Reporter abuse_ch
Tags:MassLogger zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: mailsnd3.chol.com
Sending IP: 203.252.1.124
From: 김진현 <www88@chol.com>
Subject: FW:RE:Re:?Alibaba_Inquiry_Notification?Kim_from_South_Korea_has_sent_you_an_inquiry
Attachment: Order Inquiry with Design Samples.zip (contains "Order Inquiry with Design Samples.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
59
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.23990.ZipHeur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/945de800ae672cc44cca74776ec9b3658aaa8dd14d6fef5643f6641a618a92e4/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2020-08-06 05:36:09 UTC
AV detection:
11 of 48 (22.92%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=sro6qafom4wmitgkor3w5sntmwfkvdorjvx66vsd6zsbuymkslsa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/945de800ae672cc44cca74776ec9b3658aaa8dd14d6fef5643f6641a618a92e4

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

zip 945de800ae672cc44cca74776ec9b3658aaa8dd14d6fef5643f6641a618a92e4

(this sample)

MassLogger

Executable exe 2302005fdd7c57d73c350d541fd0020b051efffdf02a4f3c3e1671cacea30043

  
Dropping
MD5 2ebff22a63913f818834de7c54a0e354
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 2302005fdd7c57d73c350d541fd0020b051efffdf02a4f3c3e1671cacea30043

Comments