MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cadea31a5b889c11ae20b3a63f17ff9ff02e69cc0df69bf81a894d22027543f1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cadea31a5b889c11ae20b3a63f17ff9ff02e69cc0df69bf81a894d22027543f1
SHA3-384 hash: 2054314d0d617f65f709da0cef6389a575102306686a4dcce921b0d5c17b9313b35c33b122766e39380e6f7642ab722a
SHA1 hash: a6c26ac7d54b567960626aa5a953799c0ae5930b
MD5 hash: 0e415a9f996a9b77edf0cc5a91d2aae4
humanhash: whiskey-stairway-twenty-echo
File name:RFQ EA0903-18.r00
Download: download sample
Signature MassLogger
Create hunting rule
File size:468'299 bytes
First seen:2020-07-16 06:46:57 UTC
Last seen:Never
File type: r00
MIME type:application/x-rar
ssdeep 12288:SxnvlZ0wUE+de4Wg23dyxbcWwOGlP8vc2yd8bKD:WN8E+dhF2ty+OyUFO
TLSH 44A4233B5213A3C6676976C016658F9FC0A3C1B7C21C61855E098B7EBA8891B6F31DCF
Reporter abuse_ch
Tags:MassLogger r00


Avatar
abuse_ch
Malspam distributing MassLogger:

HELO: iwsteel.com
Sending IP: 45.138.172.32
From: Hyun-Mi,Choi <marketing@iwsteel.com>
Reply-To: Hyun-Mi,Choi <marketing@iwsteel.com>
Subject: INQUIRY/RFQ FROM INTER WORLD STEEL.
Attachment: RFQ EA0903-18.r00 (contains "RFQ EA0903-18.exe")

MassLogger SMTP exfil server:
mail.alestayachting.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cadea31a5b889c11ae20b3a63f17ff9ff02e69cc0df69bf81a894d22027543f1/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-07-16 06:48:09 UTC
AV detection:
15 of 31 (48.39%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=zlpkggs3rcobdlrawotd6f77t7yc42ombx3jx6a2rfgseatvipyq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

r00 cadea31a5b889c11ae20b3a63f17ff9ff02e69cc0df69bf81a894d22027543f1

(this sample)

MassLogger

Executable exe c93d6c966b427a7fbc632d2f6b39a09df059b56e0c4e4a307b0318c4198219c5

  
Dropping
MD5 698ee13dea171710b6289ffe07947ae9
  
Dropping
MassLogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c93d6c966b427a7fbc632d2f6b39a09df059b56e0c4e4a307b0318c4198219c5

Comments