MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4081806d16bb4b192d516927bd81c7b009a8e0af91d3010dbf93c28940d83235. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4081806d16bb4b192d516927bd81c7b009a8e0af91d3010dbf93c28940d83235
SHA3-384 hash: b7ce9d16f0bc725121e68a6c2275ae9ff82ae45e44cc891e800505c9b3e28ba65959d4ed686ef20a1be981ad75f8bea2
SHA1 hash: d045b9eb72154c3494e0212e8de0c4224dbe6edd
MD5 hash: 1df43385fac081709498b84fef18ccc7
humanhash: stairway-lima-nuts-wisconsin
File name:SWIFT_30032131300221547_0029938344.rar
Download: download sample
Signature MassLogger
Create hunting rule
File size:943'489 bytes
First seen:2020-08-07 13:23:25 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 24576:NKYl53pyTbQRKncpIz6Exe7vbxNbHexg8i6PyuDE:Z53MbQvZEA7vbPxoyuQ
TLSH 991533D5703CAEE514AE1E0D4E4A4D8B16B77CC81C65D9F4D1A47BB0EF6830D952C2B8
Reporter abuse_ch
Tags:GoDaddy MassLogger rar


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: p3plwbeout13-01.prod.phx3.secureserver.net
Sending IP: 173.201.192.162
From: customerservice@zahrangroup.com
Subject: Payment Advice - Advice Ref:[SWIFT_30032131300221547_0029938344] / Priority payment / Customer Ref:[125059501SI5]
Attachment: SWIFT_30032131300221547_0029938344.rar (contains "SWIFT_30032131300221547_0029938344.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4081806d16bb4b192d516927bd81c7b009a8e0af91d3010dbf93c28940d83235/
Threat name:
ByteCode-MSIL.Trojan.Masson
Create hunting rule
Status:
Malicious
First seen:
2020-08-07 13:25:08 UTC
AV detection:
16 of 29 (55.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=icaya3iwxnfrslkrnet33aohwae2ryfpshjqcdn7spbisqgygi2q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/4081806d16bb4b192d516927bd81c7b009a8e0af91d3010dbf93c28940d83235

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

rar 4081806d16bb4b192d516927bd81c7b009a8e0af91d3010dbf93c28940d83235

(this sample)

MassLogger

Executable exe a05377124fe9f9a262ddb1b58d2eac7556299ec686bf5c2f005bd4792131a3c8

  
Dropping
MD5 224dfa794a92c3129e790f211bc1fe37
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a05377124fe9f9a262ddb1b58d2eac7556299ec686bf5c2f005bd4792131a3c8

Comments