MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a8a998884e55b7ad0e3f1933b1ebf3ef2ac00d0c3dd5f97788cb307f5fb5297d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a8a998884e55b7ad0e3f1933b1ebf3ef2ac00d0c3dd5f97788cb307f5fb5297d
SHA3-384 hash: f0022334f07f801c1e466fdd243a16a662538e83b860bcb47215233eb0112bd1181b543386c6fe184d0201169a9a7772
SHA1 hash: 83bb3278b4a15813a4b86b99fedc1702b16dcda4
MD5 hash: c121e586c968981307ee925d8ec2895f
humanhash: bacon-high-mississippi-potato
File name:DHL AWB NO2. 405986998.7z
Download: download sample
Signature MassLogger
Create hunting rule
File size:717'862 bytes
First seen:2020-07-02 07:19:02 UTC
Last seen:Never
File type: 7z
MIME type:application/x-rar
ssdeep 12288:svkzNABZ+7K+PVwwu62To9DglVpsImt6RngrkmOZCjtjX:WkpABw7K+SU98lVDqmngrkrZCZX
TLSH 3FE43330B50920AD8625CADBA12AF6852C78279DF5E26C81295038F9F47CFB65F94F42
Reporter abuse_ch
Tags:7z DHL MassLogger


Avatar
abuse_ch
Malspam distributing MassLogger:

HELO: jax4mhob21.registeredsite.com
Sending IP: 64.69.218.109
From: DHL EXPRESS <mehta@hortashgroup.com>
Subject: Re: ==ARRIVAL NOTICE===DHL (AWB) Delivery Notification***Docs for Customs clearance
Attachment: DHL AWB NO2. 405986998.7z (contains "DHL AWB NO2. 405986998.exe")

MassLogger SMTP exfil server:
mail.mytravelexplorer.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
87
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a8a998884e55b7ad0e3f1933b1ebf3ef2ac00d0c3dd5f97788cb307f5fb5297d/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-02 07:20:11 UTC
AV detection:
15 of 28 (53.57%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=vcuzrccokw322dr7dez3d27t54vmadimhxk7s54izmyh6x5vff6q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

7z a8a998884e55b7ad0e3f1933b1ebf3ef2ac00d0c3dd5f97788cb307f5fb5297d

(this sample)

MassLogger

Executable exe 7cee0e7a663f8a865255723ea5fe89fac90be773094c04ad82b5aee132f50cd7

  
Dropping
MD5 da17ebedd455be9c1628ff43ab03abef
  
Dropping
MassLogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7cee0e7a663f8a865255723ea5fe89fac90be773094c04ad82b5aee132f50cd7

Comments