MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4a0daade9f3d9bd65932448a0ad5fb0ba23111e58ffb0b104237198b7ff21f67. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4a0daade9f3d9bd65932448a0ad5fb0ba23111e58ffb0b104237198b7ff21f67
SHA3-384 hash: b92e6a0b098870913ace60e16f0612641ed21c18c47c6fb176fd99b54fe01535a05aa5562d6017df25ac626154099aba
SHA1 hash: 66d8e87d38d1aa197776e99fdaa47a671bf30f31
MD5 hash: 7ebb70b4722e10a27487e299e0559472
humanhash: tennis-mike-arizona-batman
File name:Specifications.gz
Download: download sample
Signature MassLogger
Create hunting rule
File size:1'083'395 bytes
First seen:2021-01-26 12:37:36 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 24576:Cerg1WvuThWuwhSAzJKiq2Gyy2+3vmudqj7jcSJUgGtggNFvbnY:CepvfZhpoiqqeRzgGtgmFc
TLSH A13533685F7A90A4FC236CB828C6111F0E1A9B7174B90D57772283C1D339F9BB58B89D
Reporter cocaman
Tags:gz


Avatar
cocaman
Malicious email (T1566.001)
From: "Tim Brunt - Cobra ASIA <isa@nuhoglulojistik.com>" (likely spoofed)
Received: "from ns1.titaniumserver.com.br (ns1.titaniumserver.com.br [179.107.83.50]) "
Date: "26 Jan 2021 00:10:54 -0800"
Subject: "Requesting A Quote"
Attachment: "Specifications.gz"

Intelligence

File Origin
# of uploads :
1
# of downloads :
130
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4a0daade9f3d9bd65932448a0ad5fb0ba23111e58ffb0b104237198b7ff21f67/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-01-26 10:06:58 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
11 of 46 (23.91%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jig2vxu7hwn5mwjsisfavvp3bordcepfr75qweccg4myw77sd5tq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
MassLogger
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4a0daade9f3d9bd65932448a0ad5fb0ba23111e58ffb0b104237198b7ff21f67

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

gz 4a0daade9f3d9bd65932448a0ad5fb0ba23111e58ffb0b104237198b7ff21f67

(this sample)

MassLogger

Executable exe c0c08f58ab9503aec6bc937a6e3f648d743d50c68726deffbdad61eefb07ad48

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c0c08f58ab9503aec6bc937a6e3f648d743d50c68726deffbdad61eefb07ad48

Comments