MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 99d4d18e906e44d3b08aede8237928a7a6866378516bd07695f2bca4fc8a954f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Intelligence 2 File information 4 Yara Comments

SHA256 hash: 99d4d18e906e44d3b08aede8237928a7a6866378516bd07695f2bca4fc8a954f
SHA3-384 hash: 35cedb81cc04cfaeff3116a998b89ec8fb663441175b4ca63e60c1e2428f61efc71c6116d6ac5acd3eeff8854c056ffb
SHA1 hash: 647ce597bc8e8924e2dace60101323d8859d704e
MD5 hash: 86105e7e57650439248e8ac3c1e8ffac
humanhash: lithium-vegan-oregon-stairway
File name:RFQ PC00056942.zip
Download: download sample
Signature n/a
File size:1'059'286 bytes
First seen:2020-06-30 06:41:24 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:d65LRIkTCFD3NwDCA0C2Hc/ddMjULDdtcCF9KiX:dcrTQy+A0Z2rXLBttF9f
TLSH D3353342CDC3393C50F631959DF87B8F69B0B4CD2CAF646AE8C8DB0819F659AD143689
Reporter @abuse_ch
Tags:MassLogger zip


Twitter
@abuse_ch
Malspam distributing MassLogger:

HELO: smtpout2.majordomo.ru
Sending IP: 78.108.80.156
From: aleshina@interpromtechnika.ru
Subject: New order PC00056942-OA3463-12
Attachment: RFQ PC00056942.zip (contains "TECHNICAL SHEET.exe")

MassLogger SMTP exfil server:
mail.mkontakt.az:587

Intelligence


Mail intelligence
Trap location Impact
Global Low
# of uploads 1
# of downloads 26
Origin country FR FR
ClamAV SecuriteInfo.com.MSIL.GenKryptik.ENGK.190.UNOFFICIAL
CERT.PL MWDB Detection:n/a
Link: https://mwdb.cert.pl/sample/99d4d18e906e44d3b08aede8237928a7a6866378516bd07695f2bca4fc8a954f/
ReversingLabs :Status:Malicious
Threat name:ByteCode-MSIL.Trojan.Agenttesla
First seen:2020-06-30 06:43:05 UTC
AV detection:19 of 48 (39.58%)
Threat level:   5/5
Spamhaus Hash Blocklist :Suspicious file
VirusTotal:No data

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

zip 99d4d18e906e44d3b08aede8237928a7a6866378516bd07695f2bca4fc8a954f

(this sample)

  
Dropping
MassLogger
  
Delivery method
Distributed via e-mail attachment

Comments