MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0b6853adaae6b9ed09af5d8fa197908f9e2c1dd2a1a677e312e55f24d35e46ba. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0b6853adaae6b9ed09af5d8fa197908f9e2c1dd2a1a677e312e55f24d35e46ba
SHA3-384 hash: 8ae9dac181331dac033b634cde9882e780ba425cbcf32ccf80b1aeea4909b0f1a90b314eed9471b1bc1ada07f223d7c8
SHA1 hash: 2a42076d72d722d64c690448c0efb23f6215b5d6
MD5 hash: eaff50d64955a83c878e7b974720fc77
humanhash: maryland-high-video-yellow
File name:INVOICE_SWIFT_ DOCUMENT_0023_110292_2020.rar
Download: download sample
Signature MassLogger
Create hunting rule
File size:748'268 bytes
First seen:2020-10-15 12:07:00 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:ebdO4U3FL9jidV7GL7jrgXvVFNV5oxnVb27H34iNgu+ndFZdXxDRihpGk:QkdFL9ji37IXrgf1V5oxVb6X4i6ndjrc
TLSH 4DF433F8186B6533D74600DC18B89334D3730FB6D3A7CC69255E4AAF1A9A275339A2D3
Reporter abuse_ch
Tags:MassLogger rar


Avatar
abuse_ch
Malspam distributing MassLogger:

HELO: pas0.noekin.net
Sending IP: 185.132.53.82
From: Ayşe Armağan GÜRER <offices@noekin.net>
Reply-To: janedoem95@gmail.com
Subject: FWD: INVOICE//SWIFT DOCUMENT.
Attachment: INVOICE_SWIFT_ DOCUMENT_0023_110292_2020.rar (contains "INVOICE_SWIFT_ DOCUMENT_0023_110292_2020.exe")

MassLogger SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0b6853adaae6b9ed09af5d8fa197908f9e2c1dd2a1a677e312e55f24d35e46ba/
Threat name:
ByteCode-MSIL.Trojan.Burkina
Create hunting rule
Status:
Malicious
First seen:
2020-10-15 10:22:23 UTC
AV detection:
23 of 48 (47.92%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=bnufhlnk42462cnplwh2df4qr6pcyhosugthpyys4vpsju26i25a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
MassLogger
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0b6853adaae6b9ed09af5d8fa197908f9e2c1dd2a1a677e312e55f24d35e46ba

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

rar 0b6853adaae6b9ed09af5d8fa197908f9e2c1dd2a1a677e312e55f24d35e46ba

(this sample)

MassLogger

Executable exe 67eb81371ab1f5b10fee97f764cc640790bb518fa452554b34ddb4f2f7f74391

  
Dropping
MD5 18dea824331a615731c085d4830186a7
  
Dropping
MassLogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 67eb81371ab1f5b10fee97f764cc640790bb518fa452554b34ddb4f2f7f74391

Comments