MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f36bed5cb221926a8f017e10bbae6f66adf06ee9df854bacbc3ab77712de391c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f36bed5cb221926a8f017e10bbae6f66adf06ee9df854bacbc3ab77712de391c
SHA3-384 hash: 7cdb0c93826bc91bdd55057841390512bdd03f4f2e5dad7ea145f2b0b0e9bbd0b2bce1d3f1a1e1e56636926805adfb47
SHA1 hash: 5165e71368396c938b1b0b9ec27d44f3686f46cb
MD5 hash: 7cd80bdb2e4b9d3acf98801b6367575e
humanhash: fanta-yankee-island-pip
File name:RFQ.iso
Download: download sample
Signature MassLogger
Create hunting rule
File size:1'071'104 bytes
First seen:2020-07-28 15:51:40 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 24576:vxpjncTNyKGXhOGTUPy5TD4hTGYztsC55H7d6:MQhl4Pi40YJ5HB6
TLSH 1235790121986B5FCB5B80B87027D0F122A7D099EB65DEB36D8FE0675AD22FE7483117
Reporter abuse_ch
Tags:iso MassLogger


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: zuoyebang.com
Sending IP: 193.142.59.88
From: Charlie MARQUETON<service@zuoyebang.com>
Subject: RFQ_270720
Attachment: RFQ.iso (contains "RFQ.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
74
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f36bed5cb221926a8f017e10bbae6f66adf06ee9df854bacbc3ab77712de391c/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-28 15:53:07 UTC
AV detection:
8 of 48 (16.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6nv62xfsegjgvdybpyilxltpm2w7a3xj36cuxlf4hk3xoew6heoa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

iso f36bed5cb221926a8f017e10bbae6f66adf06ee9df854bacbc3ab77712de391c

(this sample)

MassLogger

Executable exe 1e106807f156e828afa3dd2faca574cd0edf459289f53e83a57ac98c52e7199a

  
Dropping
MD5 103562323f65fe06d831cdb82eafe669
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1e106807f156e828afa3dd2faca574cd0edf459289f53e83a57ac98c52e7199a

Comments