MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e9a4b87658e1ad214edcc4fbffc240d9a42b6b64f06743c3c6e7849174725909. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e9a4b87658e1ad214edcc4fbffc240d9a42b6b64f06743c3c6e7849174725909
SHA3-384 hash: 09e29873288fa646d5f677274d723168f8a813406be091a2cfd74ab676cbc142bf44b1b6d97367b928ed4d0c1da34272
SHA1 hash: 0d06a5a26a96201e691d6b10d7fee55db345685d
MD5 hash: e9bd9dac156693067c2b2f3d46f35d78
humanhash: queen-arkansas-nebraska-illinois
File name:ORDER CONFIRMATION.rar
Download: download sample
Signature MassLogger
Create hunting rule
File size:690'097 bytes
First seen:2020-06-24 05:47:35 UTC
Last seen:2020-06-25 12:57:27 UTC
File type: rar
MIME type:application/x-rar
ssdeep 12288:jL1MFhPnIElb9weWV3Y/Mp/lG0XEqV8jOrZXls1Oe5EQjRVwkpRdFtmFAObQbSVe:jFgIFplGlFisseWQj3NLmTdk
TLSH EEE433A306B2F0C96A90E11E3CF0645AB6BDE13898E156906F97C0CBFB82D536573477
Reporter abuse_ch
Tags:MassLogger rar


Avatar
abuse_ch
Malspam distributing MassLogger:

HELO: damen.com
Sending IP: 37.49.224.211
From: Steven Ravestein <steven.ravestein@damen.com>
Reply-To: Steven Ravestein <steven.ravestein@damen.com>
Subject: RE: ORDER CONFIRMATION
Attachment: ORDER CONFIRMATION.rar (contains "ORDER CONFIRMATION .exe")

MassLogger SMTP exfil server:
mail.privateemail.com:587

Intelligence

File Origin
# of uploads :
3
# of downloads :
71
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e9a4b87658e1ad214edcc4fbffc240d9a42b6b64f06743c3c6e7849174725909/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-06-24 05:49:05 UTC
AV detection:
19 of 31 (61.29%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=5gslq5sy4gwsctw4yt577qsa3gscw23e6btuhq6g46cjc5dsleeq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

rar e9a4b87658e1ad214edcc4fbffc240d9a42b6b64f06743c3c6e7849174725909

(this sample)

MassLogger

Executable exe 131bfb49b5d80492ddcab3ec34448a445806e0c992c96eca65d42311539defe6

  
Dropping
MD5 fd273584ac0fade9565d581100890e10
  
Dropping
MassLogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 131bfb49b5d80492ddcab3ec34448a445806e0c992c96eca65d42311539defe6

Comments