MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1a1895c5cbfa18b25e0616134fba6f8d61eea176458e6831471f2e5c4ec72ff6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1a1895c5cbfa18b25e0616134fba6f8d61eea176458e6831471f2e5c4ec72ff6
SHA3-384 hash: 0a75db4e22339f25707a85ae1765f08ac81b9987d65c13d0fa32d2ab5e414784912bfd06df91ca70d1c6ad7942234385
SHA1 hash: 9e51dfef01779b6d0281b6e8c90672723d6ac1e7
MD5 hash: 4140f856a1c65c186696b27882de8e37
humanhash: sixteen-florida-skylark-lion
File name:1564028911-035110-sanlccjavap0004-1.r00
Download: download sample
Signature MassLogger
Create hunting rule
File size:643'030 bytes
First seen:2020-11-06 07:12:46 UTC
Last seen:Never
File type: r00
MIME type:application/x-rar
ssdeep 12288:T5bJojiozV6bHyD94haIxl5Q2i8t9ImXtyvYJWMsNg/XizqM0Matikku:Fe/ESDSbXy2Vt9ImXtyvYJWHNgb7M1G
TLSH 45D433DF790E8372169FBCD8E030D9187260372315067D40D6ACF9591AAFB6B2B4EA35
Reporter abuse_ch
Tags:ESP geo MassLogger r00 Santander


Avatar
abuse_ch
Malspam distributing MassLogger:

HELO: mail666a.masbytes.es
Sending IP: 5.56.160.160
From: Factoring y Confirming - Grupo Santander <fycout@gruposantander.es>
Subject: Notificación de demora de remesas.
Attachment: 1564028911-035110-sanlccjavap0004-1.r00 (contains "1564028911-035110-sanlccjavap0004-1.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
83
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1a1895c5cbfa18b25e0616134fba6f8d61eea176458e6831471f2e5c4ec72ff6/
Threat name:
ByteCode-MSIL.Infostealer.Maslog
Create hunting rule
Status:
Malicious
First seen:
2020-11-05 23:07:25 UTC
AV detection:
15 of 29 (51.72%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=dimjlrol7imlexqgcyju7otprvq65ilwiwhgqmkhd4xfytwhf73a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

r00 1a1895c5cbfa18b25e0616134fba6f8d61eea176458e6831471f2e5c4ec72ff6

(this sample)

MassLogger

Executable exe 10532b67aa0e421cbd04f79e1da3829be0d0a2ca5feb939f4962c7b2f79353c1

  
Dropping
MD5 98c94f48b01d4cd5c9d3ca43207ededd
  
Dropping
MassLogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 10532b67aa0e421cbd04f79e1da3829be0d0a2ca5feb939f4962c7b2f79353c1

Comments