MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 15185d2fc8f7baf088775337282f05afacd8976142a0a9b7205452521697c977. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 15185d2fc8f7baf088775337282f05afacd8976142a0a9b7205452521697c977
SHA3-384 hash: bb15220fb3a464f5cc719ce3707782a78a9f3a15237638a28b0ab353adea5bd3ca228b5d89a6784c6a1088323bb8084b
SHA1 hash: 7ec56d5930858e9896a92b8aaeb76fb0bdd78ca2
MD5 hash: 6963f0ed76bf70c527be02d0ac6b6cae
humanhash: artist-early-low-football
File name:PURCHASE -ORDER.zip
Download: download sample
Signature MassLogger
Create hunting rule
File size:832'928 bytes
First seen:2020-10-19 07:22:27 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:CYAJ1EwUE260enHBdon9E9iNuTjebwcLDKilWskkIIji2:CY81EwR260OPonJeebwcLDKiAsKei2
TLSH 1E0533DE5A19E8B11F12E1F1BE9FA8CC7F5D1030AF7157282A92B521E156422DCFDC28
Reporter abuse_ch
Tags:MassLogger zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: mail.canvadai.com
Sending IP: 192.236.236.152
From: Haruo Bando <sales@canvadai.com>
Subject: RE:PURCHASE ORDER
Attachment: PURCHASE -ORDER.zip (contains "PURCHASE -ORDER.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
88
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.InjectNET.14.14529.11600.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/15185d2fc8f7baf088775337282f05afacd8976142a0a9b7205452521697c977/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-10-19 04:08:26 UTC
AV detection:
4 of 48 (8.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=cumf2l6i665pbcdxkm3sqlyfv6wnrf3bikqktnzakrjfefuxzf3q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/15185d2fc8f7baf088775337282f05afacd8976142a0a9b7205452521697c977

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

zip 15185d2fc8f7baf088775337282f05afacd8976142a0a9b7205452521697c977

(this sample)

MassLogger

Executable exe d18f27370f8ee9d89c588980241ef2757a4a5d6cc70a357c7a45fae186c7e84b

  
Dropping
MD5 951ee81181e3409f6a76859b6b9e7ba1
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d18f27370f8ee9d89c588980241ef2757a4a5d6cc70a357c7a45fae186c7e84b

Comments