MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3dc1e41d91e98694e2dcd24d1cfc9eae355bb84493510e81e05f445a071c7ea5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3dc1e41d91e98694e2dcd24d1cfc9eae355bb84493510e81e05f445a071c7ea5
SHA3-384 hash: 0b141e1eb182500a5d0ce84901d8d80eabbb2c2f24eb8bd9af41d8c21b5e08e56acf4ed6e18e61a3dabadc92ea7420d5
SHA1 hash: 63e88cb79f51e39bb2993e6557b25639f2de9749
MD5 hash: 519115a83f5083c4706f1f5918df29b6
humanhash: kansas-kilo-three-idaho
File name:Alhammra RFQ 004-001102.PDF.r00
Download: download sample
Signature MassLogger
Create hunting rule
File size:1'090'871 bytes
First seen:2020-11-05 15:41:20 UTC
Last seen:Never
File type: r00
MIME type:application/gzip
ssdeep 24576:0398/E2Vs4WBQZZVece7t/M624PT1l9/FXzutVaV:0t8/E2q48QZZECn6lBFDutYV
TLSH AD3533031F9A1E318C2943396F939AEF7A55AB64855C7B8E4793376F6003F42A04BED4
Reporter abuse_ch
Tags:MassLogger r00


Avatar
abuse_ch
Malspam distributing MassLogger:

HELO: whmsrv01.virtualariki.com.br
Sending IP: 177.11.209.2
From: Miguel Alonso <malonso@alhammra.com>
Subject: Alhammra Request for Quotation
Attachment: Alhammra RFQ 004-001102.PDF.r00 (contains "Alhammra RFQ 004-001102.PDF.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
54
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3dc1e41d91e98694e2dcd24d1cfc9eae355bb84493510e81e05f445a071c7ea5/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-11-05 10:57:47 UTC
AV detection:
11 of 48 (22.92%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=hxa6ihmr5gdjjyw42jgrz7e6vy2vxocesniq5apal5cfuby4p2sq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

r00 3dc1e41d91e98694e2dcd24d1cfc9eae355bb84493510e81e05f445a071c7ea5

(this sample)

MassLogger

Executable exe d289aa3e60f3ab62850fb533294c99a08995da13ec6d73ed23a0d1d2312ab1c3

  
Dropping
MD5 6a6e34875503fc2c9027178d8d3df68d
  
Dropping
MassLogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d289aa3e60f3ab62850fb533294c99a08995da13ec6d73ed23a0d1d2312ab1c3

Comments