MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 47ca3858f5270e1ca3ab3494252b51524dc874a81f85f1e2b9c6434918f89a7b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 47ca3858f5270e1ca3ab3494252b51524dc874a81f85f1e2b9c6434918f89a7b
SHA3-384 hash: d305fd15f173a8a32c83491ac97d19e70ead468453870a8c54b2d5d9e61ce40decb8c9f61a8bef2d4ee99a4f0e5ce14b
SHA1 hash: 5105f5b37d362919a7b24c8cccc61d0aa5e67862
MD5 hash: 3020c992499844604e7b52730b1f2f56
humanhash: crazy-orange-spaghetti-lactose
File name:Halkbank_Ekstre_20201010_084704_520562.rar.rar
Download: download sample
Signature MassLogger
Create hunting rule
File size:999'367 bytes
First seen:2020-10-13 14:48:31 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 24576:R1LBAlU83H6oKftHE6VGQbS53zWjlH5SuujNN74sIzKpQ:RFMKoKFbHO+5SFNN4Lp
TLSH C72533C11A5D893F27C1FEB895DE5CAEDF6007CE5210F59378EA070421A666B2CE1FA1
Reporter abuse_ch
Tags:geo Halkbank MassLogger rar TUR


Avatar
abuse_ch
Malspam distributing MassLogger:

HELO: server2.enyeniweb.com
Sending IP: 45.84.189.142
From: T.HALK BANKASI A.S<HALKBANK.E-EKSTRE@halkbank.com.tr>
Reply-To: HALKBANK.E-EKSTRE@halkbank.com.tr
Subject: T.HALK BANKASI A.S. 09.10.2020 Hesap Ekstresi
Attachment: Halkbank_Ekstre_20201010_084704_520562.rar.rar (contains "ZCKH5nQQwhttNAi.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
99
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/47ca3858f5270e1ca3ab3494252b51524dc874a81f85f1e2b9c6434918f89a7b/
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=i7fdqwhve4hbzi5lgskckk2rkjg4q5fid6c7dyvzyzbusghytj5q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/47ca3858f5270e1ca3ab3494252b51524dc874a81f85f1e2b9c6434918f89a7b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

rar 47ca3858f5270e1ca3ab3494252b51524dc874a81f85f1e2b9c6434918f89a7b

(this sample)

MassLogger

Executable exe a0dd978d0c18469af2bce3de12e360921e74a22c717a3758fab3bd03f27a5496

  
Dropping
MD5 3e38e1d7210ce9bc9996d0c58844a1bb
  
Dropping
MassLogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a0dd978d0c18469af2bce3de12e360921e74a22c717a3758fab3bd03f27a5496

Comments