MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d282111dc1a969ad33e02ac8e30354907ad91c8c0c277288fffb1de2c489ec1d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d282111dc1a969ad33e02ac8e30354907ad91c8c0c277288fffb1de2c489ec1d
SHA3-384 hash: 5ddc4a0887c4004ea5881cb86992438e58359cfda0e2f1a51046c9f8636c8f162a831a0317b6d2784852bb7f22ca0a9a
SHA1 hash: d492566f26ac7b2e9116344b64ef3e2ed488de2c
MD5 hash: 349918f96e0251ce52e33e5a7e0f50da
humanhash: virginia-beryllium-twelve-five
File name:MV BULK CHILE AFG - CP DD 25th APRIL 2020- calling for discharging 48870mt of DA.img
Download: download sample
Signature MassLogger
Create hunting rule
File size:1'245'184 bytes
First seen:2020-08-16 13:51:52 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:PAwx5noTlN0ry+ob6AJvJH3lSQhMgJFt4gPASF/5t5aXa3ZLItUC9BxD4HHUxAp:Y0ZglN0mhbHoQLt4YjF/5Pzh0lR4n8C
TLSH 7E4512AA37CB6E32E229143182A333125371939B3633E70B35CC52595B1AFE58546FCE
Reporter abuse_ch
Tags:img MassLogger


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: we.webtechcool.live
Sending IP: 45.95.171.44
From: bukoil@otenet.gr
Subject: RE: MV BULK CHILE/ AFG - CP DD 25th APRIL 2020- calling for discharging 48870mt of DAP in bulk - AGENCY NOMINATION
Attachment: MV BULK CHILE AFG - CP DD 25th APRIL 2020- calling for discharging 48870mt of DA.img (contains "MV BULK CHILE AFG - CP DD 25th APRIL 2020- calling for discharging 48870mt of DA.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
80
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Artemis08A3246EE67F.4741.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d282111dc1a969ad33e02ac8e30354907ad91c8c0c277288fffb1de2c489ec1d/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-08-16 13:53:05 UTC
AV detection:
13 of 29 (44.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2kbbchobvfu22m7afleoga2usb5nshembqtxfch77mo6frej5qoq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.87
Link:
https://yomi.yoroi.company/submissions/d282111dc1a969ad33e02ac8e30354907ad91c8c0c277288fffb1de2c489ec1d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

img d282111dc1a969ad33e02ac8e30354907ad91c8c0c277288fffb1de2c489ec1d

(this sample)

MassLogger

Executable exe 3832b8b199ec2a5c06dfc3ed80a489583043e6477668370861380ee5306d9e55

  
Dropping
MD5 08a3246ee67f781b1bd84c5c9e5120a8
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3832b8b199ec2a5c06dfc3ed80a489583043e6477668370861380ee5306d9e55

Comments