MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1b32b7aa99e4362a7c000396ac6423db45af45afc3b160a04773cc98ce984cca. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1b32b7aa99e4362a7c000396ac6423db45af45afc3b160a04773cc98ce984cca
SHA3-384 hash: f9bbe324a856e9613297a4f7fa111067c594131b1eb8455bb9431cabc36bca3e0cff85f4ad2622279062c9b39545b493
SHA1 hash: 48e00c6f465d3da9e4b14c5f441271ac94f2ff66
MD5 hash: e79cd3f6e337407a0951a10dfac9bf0e
humanhash: golf-tango-potato-pizza
File name:PDF-millenniumbcp-banco.7z
Download: download sample
Signature MassLogger
Create hunting rule
File size:570'056 bytes
First seen:2020-07-02 06:56:01 UTC
Last seen:Never
File type: 7z
MIME type:application/x-rar
ssdeep 12288:CDVzfbUx3itqvna+qYJcQ7lU7guPzMv3vv10IAf:EZo9Nva+ZFuVzMv31s
TLSH 02C43345ACD0D8BD2633B14CA2774230441366FD1BA1BD4AF4F9A1D973144A0EBD8BAF
Reporter abuse_ch
Tags:7z BRA geo MassLogger


Avatar
abuse_ch
Malspam distributing MassLogger:

HELO: msr12.hinet.net
Sending IP: 168.95.4.112
From: financeiro@jchicatto.com.br
Subject: Conselho de Beneficiário do Millennium BCP
Attachment: PDF-millenniumbcp-banco.7z (contains "millenniumbcp-banco.exe")

MassLogger SMTP exfil server:
mail.saritatravels.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
84
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1b32b7aa99e4362a7c000396ac6423db45af45afc3b160a04773cc98ce984cca/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-02 06:57:07 UTC
AV detection:
16 of 28 (57.14%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=dmzlpkuz4q3cu7aaaolkyzbd3nc26rnpyoywbichopgjrtuyjtfa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

7z 1b32b7aa99e4362a7c000396ac6423db45af45afc3b160a04773cc98ce984cca

(this sample)

MassLogger

Executable exe 39ccd0e238c32ee8643fa25aa7b27f77ca8e20d831d666c301c0f9a4063656b5

  
Dropping
MD5 12f308ff12631562dd0abf6cae79c168
  
Dropping
MassLogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 39ccd0e238c32ee8643fa25aa7b27f77ca8e20d831d666c301c0f9a4063656b5

Comments