MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5268a4807bc891e93e68070094ef0ad9eb5add086acacdfe3b6393b96b3c736d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5268a4807bc891e93e68070094ef0ad9eb5add086acacdfe3b6393b96b3c736d
SHA3-384 hash: 0bd5b25b18e4964929187038c5f65e26a39af866fc6c7a887302fec962be07ba5f596d8e74c0e69c1d449eae57f5d13f
SHA1 hash: 72b39a2fdffa891b33302fd361902261df5a152d
MD5 hash: 5867db570363e8e488c216cf3ef02601
humanhash: stream-wolfram-winter-eight
File name:INQUIRY482.rar
Download: download sample
Signature MassLogger
Create hunting rule
File size:784'676 bytes
First seen:2020-08-14 09:50:35 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:DfOpkrR1pN4irOLZCBiN6q8ktYmKt2QzMZhux1WHuVu3glBOzEhyIxYYB/QhvJ4C:yykiIZ8riYmwzzMLux1WH4/6EhQYB/IT
TLSH 39F423930A6C738FF13AFCDF59AEEA046D025D5F4624E0E8599007DF52862B37A9C94C
Reporter abuse_ch
Tags:MassLogger rar


Avatar
abuse_ch
Malspam distributing MassLogger:

HELO: smtpcmd01-ws.aruba.it
Sending IP: 62.149.158.241
From: info <info@unaltrocaffe.it>
Reply-To: info@unaltrocaffe.it
Subject: RE: New Inquiry
Attachment: INQUIRY482.rar (contains "INQUIRY482.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
60
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5268a4807bc891e93e68070094ef0ad9eb5add086acacdfe3b6393b96b3c736d/
Threat name:
ByteCode-MSIL.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2020-08-14 09:52:05 UTC
AV detection:
7 of 48 (14.58%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=kjukjad3zci6sptia4ajj3yk3hvvvxiinlfm37r3moj3s2z4onwq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5268a4807bc891e93e68070094ef0ad9eb5add086acacdfe3b6393b96b3c736d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

rar 5268a4807bc891e93e68070094ef0ad9eb5add086acacdfe3b6393b96b3c736d

(this sample)

MassLogger

Executable exe 75ec88e7dccc7e244413b855f91a0105d3349f318c6caa98eb0ba3cb31055647

  
Dropping
MD5 139d7dccd185fc94fc12d84e2af2701d
  
Dropping
MassLogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 75ec88e7dccc7e244413b855f91a0105d3349f318c6caa98eb0ba3cb31055647

Comments