MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5571c3dffe6654324e0946cc08db027ed4a5889e7a766f68786c8d6612c56b74. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5571c3dffe6654324e0946cc08db027ed4a5889e7a766f68786c8d6612c56b74
SHA3-384 hash: 15af289b32a722491da470d60e5227ed148e102dd03391f37b1cb03fb4884f3807bfee01faa7346cdb88f1ab05fed048
SHA1 hash: ec66adee263a818ffe9d32f667b2d99e9d354491
MD5 hash: fe94d115ce3dd02d535c739876f8561e
humanhash: single-illinois-juliet-earth
File name:T HALK BANKASI A Åž 10 05 2020 10 09 2020 Hesap Ekstresi.rar
Download: download sample
Signature MassLogger
Create hunting rule
File size:925'200 bytes
First seen:2020-10-10 06:59:17 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 24576:Ny9qx9df9o2+FR+JF4xujve2+w6IBSKweN1PFY:Si9ovb7s2Jw6IBSKnjP2
TLSH 8A153309A3743B385A4E58C093BD89BF4AA445EABF6C67C0683D7101AB45DD6F8FC8D4
Reporter abuse_ch
Tags:Endurance geo Halkbank rar TUR


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: gproxy8-pub.mail.unifiedlayer.com
Sending IP: 67.222.33.93
From: halkbank.e-ekstre@halkbank.com.tr <support@digitalera.co.in>
Subject: T.HALK BANKASI A.Ş. 10.05.2020 - 10.09.2020 Hesap Ekstresi
Attachment: T HALK BANKASI A Åž 10 05 2020 10 09 2020 Hesap Ekstresi.rar (contains "T HALK BANKASI A Åž 10 05 2020 10 09 2020 Hesap Ekstresi.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
146
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5571c3dffe6654324e0946cc08db027ed4a5889e7a766f68786c8d6612c56b74/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-10-10 03:51:21 UTC
AV detection:
7 of 48 (14.58%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=kvy4hx76mzkdetqji3garwycp3kklce6pj3g62dynsgwmewfnn2a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/5571c3dffe6654324e0946cc08db027ed4a5889e7a766f68786c8d6612c56b74

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

rar 5571c3dffe6654324e0946cc08db027ed4a5889e7a766f68786c8d6612c56b74

(this sample)

MassLogger

Executable exe f933824c34258a344750486cb998d303aba7dcaad0dec1e12ea59929b3703dd3

  
Dropping
MD5 da855a2177854deeeae07f99a3c38ac0
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f933824c34258a344750486cb998d303aba7dcaad0dec1e12ea59929b3703dd3

Comments