MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1b6759513c42d3500a3849576c7c91d37a8352e8d789fe7ff85f7a75b79d6f5d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1b6759513c42d3500a3849576c7c91d37a8352e8d789fe7ff85f7a75b79d6f5d
SHA3-384 hash: 16e2db39f3c4b5bf646de5ab34fb1da120796e943e26bad88eeeee4e53d9e08654d2e2f29eaafee5fb109fb17eae1cd3
SHA1 hash: 74020ed610b490ef637d6ce2fadc0e852bc66056
MD5 hash: ba15752f1bd31e3a1d388c03da3154ee
humanhash: michigan-low-nineteen-pizza
File name:PURCHASE ORDER.zip
Download: download sample
Signature MassLogger
Create hunting rule
File size:908'549 bytes
First seen:2020-10-24 06:57:43 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:iKmhvTu3K432BU2C/RY3+eEmAK8vtMKBKSC+6YEYa:X6vq3r3F21iRRGStC+PEYa
TLSH 191533EBFFEB995CAB547ECF18D41FAA0CB116126C3885AFA43B4E1238758407D55A03
Reporter abuse_ch
Tags:MassLogger zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: cpsrv50.mizban.me
Sending IP: 88.99.104.194
From: tender@arena-petrogas.com
Subject: Purchase Order : PO No.: 3620117688
Attachment: PURCHASE ORDER.zip (contains "PURCHASE ORDER.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
112
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.22360.ZipHeur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1b6759513c42d3500a3849576c7c91d37a8352e8d789fe7ff85f7a75b79d6f5d/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-10-24 02:36:01 UTC
AV detection:
11 of 48 (22.92%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dntvsuj4iljvacryjflwy7er2n5iguxi26e7477yl55hln45n5oq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.52
Link:
https://yomi.yoroi.company/submissions/1b6759513c42d3500a3849576c7c91d37a8352e8d789fe7ff85f7a75b79d6f5d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

zip 1b6759513c42d3500a3849576c7c91d37a8352e8d789fe7ff85f7a75b79d6f5d

(this sample)

MassLogger

Executable exe 97f116dcd4a161a4265ccaf07dc12acec0e3e4a3af4216ba95f5f63c80a06fcd

  
Dropping
MD5 b6a71eb9fcb76acab8fc979df6a5b366
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 97f116dcd4a161a4265ccaf07dc12acec0e3e4a3af4216ba95f5f63c80a06fcd

Comments