MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4641c9cd9679e66bb5d69cb6a9b406e516a5cde6e22943a4ef783c32a1a287d1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4641c9cd9679e66bb5d69cb6a9b406e516a5cde6e22943a4ef783c32a1a287d1
SHA3-384 hash: 6ca30f9968320dcfebe0af098b174140183de66693abef41bcf58127f73d7309e887c8f581970bb827bea2b67f1f0db1
SHA1 hash: d895071f7c6a3a745c7f340367ac646e6e27ef52
MD5 hash: 0f9721713fc666d3dd923846d8149392
humanhash: idaho-quiet-purple-social
File name:Payment 10132020_pdf.iso
Download: download sample
Signature MassLogger
Create hunting rule
File size:1'572'864 bytes
First seen:2020-10-13 10:36:37 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 24576:ev6ULQpzErp36b+C6/intIxaiZcFhLdxgG6AVqi6zNL:eSULqzK5QkaNDQG+R
TLSH 9775121033B85B63D43EE7F91226A0402BB536172461E61DFECA55DF6B39F220681FA7
Reporter abuse_ch
Tags:iso MassLogger


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: panelhosting3.indosatm2.com
Sending IP: 202.155.27.141
From: Daniel Zhao <andrea.kovacs@gpipharma.ie>
Reply-To: Daniel Zhao <rahmati@kitoenterprises.co>
Subject: Re: Payment
Attachment: Payment 10132020_pdf.iso (contains "FHCQ1YC0JqmEr9D.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
80
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Inject4.3009.28267.29331.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4641c9cd9679e66bb5d69cb6a9b406e516a5cde6e22943a4ef783c32a1a287d1/
Threat name:
ByteCode-MSIL.Infostealer.Stelega
Create hunting rule
Status:
Malicious
First seen:
2020-10-13 06:03:51 UTC
AV detection:
25 of 48 (52.08%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=iza4ttmwphtgxnowts3ktnag4ulkltpg4iuuhjhppa6dfincq7iq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.45
Link:
https://yomi.yoroi.company/submissions/4641c9cd9679e66bb5d69cb6a9b406e516a5cde6e22943a4ef783c32a1a287d1

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

iso 4641c9cd9679e66bb5d69cb6a9b406e516a5cde6e22943a4ef783c32a1a287d1

(this sample)

MassLogger

Executable exe b0d7806609d30bdbfcb6e56320094558d6f3cd2c2c3f0e8e4479475d69160c41

  
Dropping
MD5 8874ea0ece51fe06e3a7dc092772da57
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b0d7806609d30bdbfcb6e56320094558d6f3cd2c2c3f0e8e4479475d69160c41

Comments