MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5b3b6f608cdabbb7166b7462f5becb29723c908584b643a6cda21a27d1a6ece7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5b3b6f608cdabbb7166b7462f5becb29723c908584b643a6cda21a27d1a6ece7
SHA3-384 hash: 0157d00cacdf3422d08c1be5a62ab6927f4e2361de7f43d91ab88f43d399e5caba7a1ecd44468a74c573bb02f4a310a1
SHA1 hash: 1553354a873f021f40df5d27c4ce1b5b916c23d4
MD5 hash: 08ded15be65e130d2c8cc3789e173267
humanhash: double-seven-mirror-cup
File name:PO 858639 vendor.rar
Download: download sample
Signature MassLogger
Create hunting rule
File size:884'242 bytes
First seen:2020-11-20 07:38:38 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 24576:Db2b/XZqOFAe/oU1lIkYUcG70K2AgyQQTB:Dab/XhA41lIkYI0K2ABZTB
TLSH 08153353772AD94B8BC75939F6971AEFCE500135C858924131833BC9DD38922ABB1B47
Reporter abuse_ch
Tags:rar


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: veeco.com
Sending IP: 101.99.91.207
From: Jill Shelley <JShelley@veeco.com>
Subject: New Order #858639
Attachment: PO 858639 vendor.rar (contains "PO 858639 vendor.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
n/a
Vendor Threat Intelligence
Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5b3b6f608cdabbb7166b7462f5becb29723c908584b643a6cda21a27d1a6ece7/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-11-19 21:16:23 UTC
AV detection:
12 of 48 (25.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=lm5w6yem3k53oftlorrplpwlffzdzeefqs3ehjwnuincpung5ttq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

rar 5b3b6f608cdabbb7166b7462f5becb29723c908584b643a6cda21a27d1a6ece7

(this sample)

MassLogger

Executable exe 0bb9226c32e2505fc4f25a368e909afd29152096ac001aa604eda6ca16b34a3f

  
Dropping
MD5 13dac49a8fa76b2c8839783922398ea2
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0bb9226c32e2505fc4f25a368e909afd29152096ac001aa604eda6ca16b34a3f

Comments