MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 298d787eac0194804fbd8e3961a90c332087ee9192053006fc62bdfc089928b6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 298d787eac0194804fbd8e3961a90c332087ee9192053006fc62bdfc089928b6
SHA3-384 hash: 4d501f28dd203b37780462eb290c87e4bd86e36960307d0be9aebeb7f102d4bf3441bbd3ab5fd8524d67dc2cfcd55b61
SHA1 hash: 12ecc54b82e7b1cc3e1b17b9baf4772456d787d4
MD5 hash: f5df7b351800863f13201e44e0252d0b
humanhash: bulldog-potato-lima-spaghetti
File name:INQUIRY_PDF.gz
Download: download sample
Signature MassLogger
Create hunting rule
File size:763'140 bytes
First seen:2020-10-16 12:38:25 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:hSs9WijPlsrq9LsRty4G0skJe49VglXbE0pXrFAnmmRCr0o0Z+vPezSCxnQ/cgDl:8trzvXGbqe49+h40tpAnmGCr0oIaPe3c
TLSH 19F423A4A72D4F1A625701B03658A0438CC31B75FAC9CEFFCD248DF868EF5BA5476648
Reporter abuse_ch
Tags:gz MassLogger


Avatar
abuse_ch
Malspam distributing MassLogger:

HELO: logisticservices.net
Sending IP: 95.211.253.194
From: David Russell <dave@logisticservices.net>
Subject: New Purchase order 484967
Attachment: INQUIRY_PDF.gz (contains "INQUIRY_PDF.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/298d787eac0194804fbd8e3961a90c332087ee9192053006fc62bdfc089928b6/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-10-16 06:38:56 UTC
AV detection:
16 of 47 (34.04%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=fggxq7vmagkiat55ry4wdkimgmqip3ursictabx4mk67ycezfc3a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/298d787eac0194804fbd8e3961a90c332087ee9192053006fc62bdfc089928b6

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

zip 298d787eac0194804fbd8e3961a90c332087ee9192053006fc62bdfc089928b6

(this sample)

MassLogger

Executable exe 1e9ff9549343dcb17dcb137508657a94e5503579e0e0741443b27c732b62fa5c

  
Dropping
MD5 9d436f5ab89ee15932668ab6e921806c
  
Dropping
MassLogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1e9ff9549343dcb17dcb137508657a94e5503579e0e0741443b27c732b62fa5c

Comments