MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2234b93f14f3643cce17c1562c97120e89e2d87e329809a05c033e6fd5b0322c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2234b93f14f3643cce17c1562c97120e89e2d87e329809a05c033e6fd5b0322c
SHA3-384 hash: 03908d45dc59b871c79fe33aa9eb474d21401402674c8775a45def5b9085562d0ec5f96ffe80b7622d0def8733659000
SHA1 hash: 8fe3cc2ef20ec2c32850259897226563f96cf795
MD5 hash: 22af0714fb72629cc0e1af50d9f0d7e6
humanhash: dakota-utah-solar-lake
File name:PI1009372PDF.7z
Download: download sample
Signature MassLogger
Create hunting rule
File size:782'766 bytes
First seen:2020-08-06 08:00:54 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:eAQft05qvLaCoBaLCESsonaKK8BRM/Ssv6/byHm6Pby74oGrsR:GO5qnoB2C/sS3pO6/WHmt4oGYR
TLSH DCF4236E79C8D4D893F16F83B902025D8261CA97241FD4C987E74434E7E6EB83B4562F
Reporter abuse_ch
Tags:7z MassLogger


Avatar
abuse_ch
Malspam distributing MassLogger:

HELO: rdns0.fresna.xyz
Sending IP: 164.90.155.99
From: "VU , Hong"<office@fresna.xyz>
Reply-To: <erikw.gohomeltd@gmail.com>
Subject: RE: RE: Request of Status of Quote
Attachment: PI1009372PDF.7z (contains "PI1009372PDF.exe")

MassLogger SMTP exfil server:
webmail.saritatravels.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2234b93f14f3643cce17c1562c97120e89e2d87e329809a05c033e6fd5b0322c/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-08-06 06:37:29 UTC
AV detection:
20 of 29 (68.97%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ei2lspyu6nsdztqxyflczfysb2e6fwd6gkmatic4am7g7vnqgiwa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2234b93f14f3643cce17c1562c97120e89e2d87e329809a05c033e6fd5b0322c

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

zip 2234b93f14f3643cce17c1562c97120e89e2d87e329809a05c033e6fd5b0322c

(this sample)

MassLogger

Executable exe 1b59de7a97df74d5e59c0f02697e9ae4e9391a01998de6baf4c937bdf2f678f5

  
Dropping
MD5 029bc6a7b0e7987195c6b17fa6887b1a
  
Dropping
MassLogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1b59de7a97df74d5e59c0f02697e9ae4e9391a01998de6baf4c937bdf2f678f5

Comments