MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 37ff240d32a3c886b0ed9d7b9bbd094988219c68c42946472946ff6a5ba05cdd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 37ff240d32a3c886b0ed9d7b9bbd094988219c68c42946472946ff6a5ba05cdd
SHA3-384 hash: ca60d1f9539fab1481702c17bb833e8a29e2e8d1ee639e20aa99f6f1eb48c4f155f2b83de6f0c84b84d552ed163a9262
SHA1 hash: d6dbd8858d3a938550308e9f3dd609a44b61fed9
MD5 hash: 1bada3df0e09ca66151ad73b60abaaba
humanhash: emma-texas-pluto-magnesium
File name:RQF.49254960 annex.r00
Download: download sample
Signature MassLogger
Create hunting rule
File size:922'963 bytes
First seen:2020-07-29 06:26:45 UTC
Last seen:Never
File type: r00
MIME type:application/x-rar
ssdeep 24576:ALRV8JIPlJIbfLM0RC6Gy9FxYhMn5iFkmZ9:AHn9Jv0b9ohMn5c39
TLSH E91533655FF53B6388028E29301472464534FB56F2A378A0DEF53167C8B76FC92AA70E
Reporter abuse_ch
Tags:MassLogger r00


Avatar
abuse_ch
Malspam distributing MassLogger:

HELO: grl.com.tr
Sending IP: 156.96.118.60
From: Selim Arslan <accounts@grl.com.tr>
Reply-To: ellisfalconresources@mail.com
Subject: Re: End of July RQF.49254960 annex
Attachment: RQF.49254960 annex.r00 (contains "RQF.49254960 annex.exe")

MassLogger SMTP exfil server:
smtp.yandex.com.tr:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
58
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/37ff240d32a3c886b0ed9d7b9bbd094988219c68c42946472946ff6a5ba05cdd/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-29 06:28:09 UTC
AV detection:
15 of 28 (53.57%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=g77sidjsupeinmhntv5zxpijjgecdhdiyquumrzji37wuw5altoq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.45
Link:
https://yomi.yoroi.company/submissions/37ff240d32a3c886b0ed9d7b9bbd094988219c68c42946472946ff6a5ba05cdd

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

r00 37ff240d32a3c886b0ed9d7b9bbd094988219c68c42946472946ff6a5ba05cdd

(this sample)

MassLogger

Executable exe 9d12d73cdddda4b11bbfa38b1bc056e20063a75f38decb5e8af5e6a30c078673

  
Dropping
MD5 05b38d4a44ea9242439c3143809cc1e5
  
Dropping
MassLogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9d12d73cdddda4b11bbfa38b1bc056e20063a75f38decb5e8af5e6a30c078673

Comments