MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1dc8e1ca1cf615a5302b8b4a8562d22d8aead04f9d6d00d6a52d58f105607e12. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1dc8e1ca1cf615a5302b8b4a8562d22d8aead04f9d6d00d6a52d58f105607e12
SHA3-384 hash: 2371a0a00036d70255233e1bcb376d9b01512e8af73ef648b3d1e462d03364b70198b3931512e825a7b1f4b99d89d0ba
SHA1 hash: 4a86123782f9fcb0abddbf8f06d9c93981c6edcd
MD5 hash: 28481a8791252084f1ddd148404e0717
humanhash: one-seven-tango-cola
File name:CHANG_10928748.rar
Download: download sample
Signature MassLogger
Create hunting rule
File size:1'069'087 bytes
First seen:2020-08-04 10:50:37 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 24576:wfDLcNSNODYVhGkM2eUtFNGRfN8JEksioweEcwtMjy:wLySLVhvMp+2fW9shwedwye
TLSH 54353352A4F1421404A773F2AD3EB6AC0268B5D66940E5A95C17CB3FD309D3AFBC5478
Reporter abuse_ch
Tags:MassLogger rar Yahoo


Avatar
abuse_ch
Malspam distributing MassLogger:

HELO: sonic312-21.consmr.mail.sg3.yahoo.com
Sending IP: 106.10.244.211
From: Angolan Semba <sangolansemba@yahoo.com.sg>
Subject: : Fwd: Wire Transfer Payment
Attachment: CHANG_10928748.rar (contains "CHANG_10928748.exe")

MassLogger SMTP exfil server:
smtp.yandex.ru:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
56
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1dc8e1ca1cf615a5302b8b4a8562d22d8aead04f9d6d00d6a52d58f105607e12/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-08-04 10:52:06 UTC
AV detection:
15 of 29 (51.72%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=dxeodsq46yk2kmblrnfikywsfwfovucptvwqbvvffvmpcblapyja._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1dc8e1ca1cf615a5302b8b4a8562d22d8aead04f9d6d00d6a52d58f105607e12

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

rar 1dc8e1ca1cf615a5302b8b4a8562d22d8aead04f9d6d00d6a52d58f105607e12

(this sample)

MassLogger

Executable exe f38bf49d1b80576d1df0cea02b590d52b16dfd03acfa6f9776fb010bd88ec38d

  
Dropping
MD5 b8681b59671bbc3bfdf4b983f913bf6f
  
Dropping
MassLogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f38bf49d1b80576d1df0cea02b590d52b16dfd03acfa6f9776fb010bd88ec38d

Comments