MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b3918b3f0ec8f321ec006fc4455e1e2c92f2122ae2767c5576a1d30cb0c764ef. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b3918b3f0ec8f321ec006fc4455e1e2c92f2122ae2767c5576a1d30cb0c764ef
SHA3-384 hash: 78785d8fefced2b44390871f8bfcd2062f1b1217256694c9fc1f254fe76bfb3afbec4bcb24faacefc5174d6d88c5a6b9
SHA1 hash: 4a5de2eec3977d4d47709af15abb79a3e2c0234e
MD5 hash: 8bb85daeb342d6631bbb76e16e19113a
humanhash: mango-jupiter-uncle-white
File name:CATALOGUE RMK TRADING LTD_PDF.iso
Download: download sample
Signature MassLogger
Create hunting rule
File size:960'512 bytes
First seen:2020-07-04 07:23:50 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 24576:6MpPfCEdolsADzCYshDJoihkpd/WBI+xa4DSvq1rJ7q7:5lfChjDzd2yim004DSvY9
TLSH 371502512BA48726C6BAB7F54563581C03B3B836E575FA0C2FCE90EE0B27B508E5075B
Reporter abuse_ch
Tags:iso MassLogger


Avatar
abuse_ch
Malspam distributing MassLogger:

HELO: seth25.seeweb.it
Sending IP: 95.174.9.189
From: RMK Trading LTD <c.eomirou@rmk.es>
Subject: ORDER 03072020_22
Attachment: CATALOGUE RMK TRADING LTD_PDF.iso (contains "CATALOGUE RMK TRADING LTD_PDF.exe")

MassLogger SMTP exfil server:
smtp.yandex.ru:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
85
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.GenKryptik.ENOW.30129.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b3918b3f0ec8f321ec006fc4455e1e2c92f2122ae2767c5576a1d30cb0c764ef/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-04 07:25:06 UTC
AV detection:
13 of 29 (44.83%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=woiywpyozdzsd3aan7cekxq6fsjpeerk4j3hyvlwuhjqzmghmtxq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

iso b3918b3f0ec8f321ec006fc4455e1e2c92f2122ae2767c5576a1d30cb0c764ef

(this sample)

MassLogger

Executable exe 5f10de50b259a82ec6229168b4ed55aca2959b445051abd78d2cb2ab51f321f8

  
Dropping
MD5 dbea2b919f6457af66a3f4080d989f0f
  
Dropping
MassLogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 5f10de50b259a82ec6229168b4ed55aca2959b445051abd78d2cb2ab51f321f8

Comments