MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4ad92d3574f4a1fe6959458504f0250a00e37ac0da261f5cc2d9843bbbd9fe88. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4ad92d3574f4a1fe6959458504f0250a00e37ac0da261f5cc2d9843bbbd9fe88
SHA3-384 hash: 2b74de13e0816f0b0ccb13efd14912ea9bae09d0a1b6c81441ad86ddcab4b27c18381410b466b94f97868d56002cf0df
SHA1 hash: b341d3c95dd8960dacd385c41fb5d9fb7448dbfd
MD5 hash: e9b214d30e805d4e526686721e01b755
humanhash: glucose-comet-undress-pizza
File name:Hesap hareketleriniz PDF 1.rar
Download: download sample
Signature MassLogger
Create hunting rule
File size:814'238 bytes
First seen:2020-08-06 05:10:10 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 24576:bEkcmBD+aw/hvTxA8O0WC4Zbuc7VrZ6gtniv:BcmBD+aQhK8OMcprTwv
TLSH 4905331F14EA7BAB4543F3DF3545583CA3D601EEAAE265FC833A291026F17D33069A46
Reporter abuse_ch
Tags:geo MassLogger rar TUR


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: cpanel.medicompc.com
Sending IP: 92.42.36.231
From: Garanti Bankasi <ekstre@garanti.com.tr>
Reply-To: noreply <noreply@garanti.com.tr>
Subject: Hesap hareketleriniz
Attachment: Hesap hareketleriniz PDF 1.rar (contains "77777777.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
56
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4ad92d3574f4a1fe6959458504f0250a00e37ac0da261f5cc2d9843bbbd9fe88/
Threat name:
Win32.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2020-08-06 05:12:06 UTC
AV detection:
13 of 48 (27.08%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jlms2nlu6sq742kziwcqj4bfbiaog6wa3itb6xgc3gcdxo6z72ea._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/4ad92d3574f4a1fe6959458504f0250a00e37ac0da261f5cc2d9843bbbd9fe88

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

rar 4ad92d3574f4a1fe6959458504f0250a00e37ac0da261f5cc2d9843bbbd9fe88

(this sample)

MassLogger

Executable exe a564fdfc9313e139ccabe2e6b1154598ea3baebd20abde1125a6513789b54fa4

  
Dropping
MD5 ade1ce6f933130caa6aa7df5bfc0419f
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a564fdfc9313e139ccabe2e6b1154598ea3baebd20abde1125a6513789b54fa4

Comments