MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ea1d486ee6b3c2dd96db4f2bc1236f4c40d2b7d3a8a060f3348fab00c98832db. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ea1d486ee6b3c2dd96db4f2bc1236f4c40d2b7d3a8a060f3348fab00c98832db
SHA3-384 hash: 21e5961c2be04d952c2730d06295e3666a918873d4f1ffedb19a4f267be15ad2cc2d310cda10832c999c9f03de0682a3
SHA1 hash: 8387a44e38af3ce832e1d7a20159596d80d43124
MD5 hash: cac3a043c324c1a1edadca21182da675
humanhash: nine-uranus-july-red
File name:Purchase Order_pdf.rar
Download: download sample
Signature MassLogger
Create hunting rule
File size:833'035 bytes
First seen:2020-06-18 09:42:56 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 24576:ANUP/c2k4Ojg50N4+QvEGMkwJqzl3oPa1d:yUP/c24v430qh3Fd
TLSH AE0523709EB2FEED720D09EA9FAF42ACC418655096762DF0B434D212D5C183ED2AB537
Reporter abuse_ch
Tags:MassLogger rar


Avatar
abuse_ch
Malspam distributing MassLogger:

HELO: slot0.meplesci.com
Sending IP: 45.95.169.70
From: Eric Wang <info@meplesci.com>
Reply-To: info@meplesci.com
Subject: REQUEST FOR QUOTATION - NO: 792-286
Attachment: Purchase Order_pdf.rar (contains "Purchase Order_pdf.exe")

MassLogger SMTP exfil server:
mail.mytravelexplorer.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
78
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27382.Rar5Heur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Infostealer.BitStealer
Create hunting rule
Status:
Malicious
First seen:
2020-06-18 10:37:36 UTC
AV detection:
21 of 31 (67.74%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=5iouq3xgwpbn3fw3j4v4ci3pjranfn6tvcqgb4zur6vqbsmiglnq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

rar ea1d486ee6b3c2dd96db4f2bc1236f4c40d2b7d3a8a060f3348fab00c98832db

(this sample)

MassLogger

Executable exe 7c8962ad0cf0487df0793c34b8bba9b9fbb83e88287afa9761083e3d7b4eda36

  
Dropping
MD5 46f6a9c3798b0a265c883914b575f582
  
Dropping
MassLogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7c8962ad0cf0487df0793c34b8bba9b9fbb83e88287afa9761083e3d7b4eda36

Comments