MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bae5c09e88e3a4540c3586bbfcc5fe3b72f6198893b46b31d1d870551b57cca9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bae5c09e88e3a4540c3586bbfcc5fe3b72f6198893b46b31d1d870551b57cca9
SHA3-384 hash: 1ff4d17e8b0a6353b661ca314254e4d6153f5bd15c1188a7f48e72dbc5af8f2536af2b85c0b802726d318749b8b31cce
SHA1 hash: 88e96020c19edf2c63fdf40062c71805dfb57b98
MD5 hash: a9d5d6466a5b4374eb90dc685cefdbb8
humanhash: nevada-wisconsin-item-angel
File name:QUOTE CIF PRICES FOR ATTACHED.zip
Download: download sample
Signature MassLogger
Create hunting rule
File size:1'010'513 bytes
First seen:2020-08-18 06:23:01 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:Lle2cAoqzwdrSvJgpXN51AYxDphMUerurCQu47J:L82cAsd+vupd9xzM1CrHu47J
TLSH E325335C1AFAB52242DD42167B3F9A4AFF1F46A60989790CE31F76E4A0CE634CDCC119
Reporter abuse_ch
Tags:MassLogger zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: mailsnd1.chol.com
Sending IP: 203.252.1.138
From: dwmetal <dwmetal@chol.com>
Subject: FW:RE:Price Inquiry
Attachment: QUOTE CIF PRICES FOR ATTACHED.zip (contains "QUOTE CIF PRICES FOR ATTACHED.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
60
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bae5c09e88e3a4540c3586bbfcc5fe3b72f6198893b46b31d1d870551b57cca9/
Threat name:
ByteCode-MSIL.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2020-08-18 06:24:10 UTC
AV detection:
16 of 48 (33.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xls4bhui4osfidbvq257zrp6hnzpmgmiso2gwmor3byfkg2xzsuq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

zip bae5c09e88e3a4540c3586bbfcc5fe3b72f6198893b46b31d1d870551b57cca9

(this sample)

MassLogger

Executable exe 9dfba413d306830589105d96b90b5ea870b1975bd371350635ea1c2b591bcbd8

  
Dropping
MD5 4fb2fccce8717ef3702f39eb45167924
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9dfba413d306830589105d96b90b5ea870b1975bd371350635ea1c2b591bcbd8

Comments