MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 14f0082593845882e68fd58fb01f3b93d70f86e73bbb7cd26ec4f7aebc49b8c8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 14f0082593845882e68fd58fb01f3b93d70f86e73bbb7cd26ec4f7aebc49b8c8
SHA3-384 hash: 95f0fa0b83b222b8e517198d9aa4ad576c4b890e0c46a964f9fb2a9257f20988f0c6af6099e29fced5267a02cce7ebe9
SHA1 hash: b549bc2b413fb5dc845a2c6058b663ee20341c40
MD5 hash: 934024401ef4cd2281555a04d9ff3ea5
humanhash: alpha-don-nebraska-lamp
File name:Hesap Hareketleri.rar
Download: download sample
Signature MassLogger
Create hunting rule
File size:822'484 bytes
First seen:2020-10-27 14:30:23 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 24576:S7yCWQf0j313xQ+d3dD2HNxV/osrw4Vnqaro:SD0713++d3dD2H84Vnqn
TLSH A405234A78C76BFE497EF3910A877DA40704D007A49D6FB0870ABF00A675F89DF499A4
Reporter abuse_ch
Tags:GarantiBBVA geo MassLogger rar TUR


Avatar
abuse_ch
Malspam distributing MassLogger:

HELO: m1mkyc5j.ni.net.tr
Sending IP: 89.252.168.58
From: Garanti BBVA <garanti@garantibbva.com.tr>
Reply-To: noreply <mintchin1@gmail.com>
Subject: Günlük Hesap Hareketleri Bilgilendirmesi
Attachment: Hesap Hareketleri.rar (contains "LEromjGN7YzQ9n9.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
74
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/14f0082593845882e68fd58fb01f3b93d70f86e73bbb7cd26ec4f7aebc49b8c8/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2020-10-27 12:34:25 UTC
AV detection:
2 of 48 (4.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ctyaqjmtqrmifzup2wh3ahz3splq7bxhho5xzutoyt325pcjxdea._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/14f0082593845882e68fd58fb01f3b93d70f86e73bbb7cd26ec4f7aebc49b8c8

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

rar 14f0082593845882e68fd58fb01f3b93d70f86e73bbb7cd26ec4f7aebc49b8c8

(this sample)

MassLogger

Executable exe 78a59829f0dd9b3ec88a68096284de67dd8806d3690d11f017f7b2893a98354d

  
Dropping
MD5 55c05cbf3e1acf151f1cb5d336964ecd
  
Dropping
MassLogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 78a59829f0dd9b3ec88a68096284de67dd8806d3690d11f017f7b2893a98354d

Comments