MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 64661c33491d2f36f4012a5654e972dd2fe5440d1243a31c331ad37d7b8329d9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 64661c33491d2f36f4012a5654e972dd2fe5440d1243a31c331ad37d7b8329d9
SHA3-384 hash: a5a24f89ca8f09c77fb3c1a00a5135689c7de4d4a74cffdb2306789cb4c1c58d784283950595872c4d80e2b0a18dbe88
SHA1 hash: 3d9834a89b60897c231de7135f023bb5d42f9cb3
MD5 hash: 5b702333212392f1c272c8c5fb48fc9b
humanhash: hydrogen-nine-july-mobile
File name:inquiry specification.zip
Download: download sample
Signature MassLogger
Create hunting rule
File size:938'126 bytes
First seen:2020-08-06 06:45:58 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:i/asflKh2JoF0EenPInOU/fJU1nEdzgWgmCy0kcdzg:i/asNK4oF0QOU/fJ+nEd8U1cW
TLSH 8F15336C7AD8AB8193328011ECD6F81931AE4BF22E8B82E47CF1D37571D3145972A4DD
Reporter abuse_ch
Tags:MassLogger zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: wbironout1.netvigator.com
Sending IP: 210.87.247.7
From: Omeir Nasser Al Falahy & Partners <market002@netvigator.com>
Subject: Please offer your best price for the attached items list.
Attachment: inquiry specification.zip (contains "inquiry specification.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
60
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/64661c33491d2f36f4012a5654e972dd2fe5440d1243a31c331ad37d7b8329d9/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-08-06 04:38:26 UTC
AV detection:
18 of 48 (37.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=mrtbym2jduxtn5abfjlfj2ls3ux6krancjb2ghbtdljx264dfhmq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.61
Link:
https://yomi.yoroi.company/submissions/64661c33491d2f36f4012a5654e972dd2fe5440d1243a31c331ad37d7b8329d9

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

zip 64661c33491d2f36f4012a5654e972dd2fe5440d1243a31c331ad37d7b8329d9

(this sample)

MassLogger

Executable exe 9a39817abcaf9b2ad45fecd4aec867e6989ece31d2dd41410622af0fc6547444

  
Dropping
MD5 96ded925029c99194d0d559c6d7d6923
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9a39817abcaf9b2ad45fecd4aec867e6989ece31d2dd41410622af0fc6547444

Comments