MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 036599494a33cab7b197f0aaa2af147c99e8526c7791c4d7aed91e8bef2ab301. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 036599494a33cab7b197f0aaa2af147c99e8526c7791c4d7aed91e8bef2ab301
SHA3-384 hash: a0e3bb9faa7f438c171ef74b49e57f12fb0f163ac28c1d052af36b42438b3d29102f41aad5926950e36bde3cbd01396b
SHA1 hash: 965e6130d04a8d86ab27fc3aa59d04db1927550b
MD5 hash: cfcd5c8ab4988c826562453dd7eed8f0
humanhash: potato-bluebird-robert-muppet
File name:Order 01001O02.zip
Download: download sample
Signature MassLogger
Create hunting rule
File size:197'740 bytes
First seen:2020-10-15 11:38:32 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 3072:E5+kMLw0I6MFpfxfjlQIGjQ/yqMMTd6tSXtYHYzbWLf0Pa1lbrQ/9fPDrK4Zfbsb:E5EEN6MTfxJQIGGZk0ybrQc4ZzsU8
TLSH C714127EA6A7AF95E0D25070EC7B128F71347D027184E8B5F0B5A88FC086C6D495C6AF
Reporter abuse_ch
Tags:MassLogger zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: condor3828.startdedicated.com
Sending IP: 148.72.158.138
From: Pablo Silvage <sales.bigfzabric@gmail.com>
Reply-To: admin@nom-uk.com
Subject: Urgent Order 01001O02
Attachment: Order 01001O02.zip (contains "Order 01001O02.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
72
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.23990.ZipHeur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/036599494a33cab7b197f0aaa2af147c99e8526c7791c4d7aed91e8bef2ab301/
Threat name:
ByteCode-MSIL.Spyware.Negasteal
Create hunting rule
Status:
Malicious
First seen:
2020-10-14 23:47:32 UTC
AV detection:
28 of 48 (58.33%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=anszsskkgpflpmmx6cvkflyupsm6qutmo6i4jv5o3epix3zkwmaq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.97
Link:
https://yomi.yoroi.company/submissions/036599494a33cab7b197f0aaa2af147c99e8526c7791c4d7aed91e8bef2ab301

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

zip 036599494a33cab7b197f0aaa2af147c99e8526c7791c4d7aed91e8bef2ab301

(this sample)

MassLogger

Executable exe c2e30f7fb4bd1be4de7a4322f2a1d1b489259c1a54cc372a55148eca640d5a9e

  
Dropping
MD5 bb0c51c972de3ad14654d9505ca69049
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c2e30f7fb4bd1be4de7a4322f2a1d1b489259c1a54cc372a55148eca640d5a9e

Comments