MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 55247605abdc8ef6f7ad3bb5eed601a6b5da5205785ac51a9407f0d1dcde9b6d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 55247605abdc8ef6f7ad3bb5eed601a6b5da5205785ac51a9407f0d1dcde9b6d
SHA3-384 hash: c28d698ae5867118fd74122cdc36976161b1ecd251b21ee5d96336a7576d5c5cbb6ecc5f2365395b943fad678b21edfe
SHA1 hash: f9605a988006ada60bdf14deb997e171bcb00e7f
MD5 hash: 5347636231c0a9a6a31c0086eea12c32
humanhash: august-football-sierra-fish
File name:LIST OF PRODUCTS NEEDED.zip
Download: download sample
Signature MassLogger
Create hunting rule
File size:940'296 bytes
First seen:2020-11-18 06:29:46 UTC
Last seen:2020-11-27 10:31:55 UTC
File type: zip
MIME type:application/zip
ssdeep 24576:5cDlvs3L0iKbtieilP6PsVErVBBhmJdaxsj0:eDl0hKsJKhPBhmJdaqI
TLSH 90152372ACA63747C61F0E92815C4B6FEF25A6E428871C963C88CF77599BC064BD074E
Reporter cocaman
Tags:zip


Avatar
cocaman
Malicious email (T1566.001)
From: "Purchase Department <redessociales@acciona.com>" (likely spoofed)
Received: "from acciona.com (unknown [103.145.252.171]) "
Date: "17 Nov 2020 14:18:12 -0800"
Subject: "RE: URGENT REQUEST FOR QUOTATION AND PROFORMA INVOICE"
Attachment: "LIST OF PRODUCTS NEEDED.zip"

Intelligence

File Origin
# of uploads :
34
# of downloads :
104
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.DownLoader35.51022.16023.14933.UNOFFICIAL
Create hunting rule

Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/55247605abdc8ef6f7ad3bb5eed601a6b5da5205785ac51a9407f0d1dcde9b6d/
Threat name:
ByteCode-MSIL.Backdoor.NanoCore
Create hunting rule
Status:
Malicious
First seen:
2020-11-17 21:35:17 UTC
File Type:
Binary (Archive)
Extracted files:
24
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=kushmbnl3shpn55nho265vqbu225uuqfpbnmkguua7yndxg6tnwq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

zip 55247605abdc8ef6f7ad3bb5eed601a6b5da5205785ac51a9407f0d1dcde9b6d

(this sample)

MassLogger

Executable exe e97151ce51e9463bd45ad41571141614fc0ffc8a8cbf2c74f36c20028a769f41

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e97151ce51e9463bd45ad41571141614fc0ffc8a8cbf2c74f36c20028a769f41

Comments