MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6a6814b92ba876b6f4977b0b176c87a7f5daa5bed67ac262de08742aad6c7e08. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6a6814b92ba876b6f4977b0b176c87a7f5daa5bed67ac262de08742aad6c7e08
SHA3-384 hash: 5a1301367591a33309d4093f32b30fa630bf25971548f5fbd77f04b31c434c4b352ca51f3448ca22e84a53c2c596043a
SHA1 hash: 6b813abd9c1a32f0c9fd2242717e1de971583215
MD5 hash: ebf81eed9ef8ebabe8cd05856ee20fa8
humanhash: vermont-fix-east-enemy
File name:Bank details,pdf.r00
Download: download sample
Signature MassLogger
Create hunting rule
File size:762'966 bytes
First seen:2020-07-29 06:43:03 UTC
Last seen:Never
File type: r00
MIME type:application/x-rar
ssdeep 12288:/ujvK7ZuVWpkto120rukvqkburs9Bc7mvnbW0Edx0JCOT6PWduv:scvMo1TukikqAYmfzE0C6+
TLSH 1EF4239134E88DFB95FB23004C918FB7B978A5849697C62C7E428C192DB6D4E47E5F30
Reporter abuse_ch
Tags:MassLogger r00


Avatar
abuse_ch
Malspam distributing MassLogger:

HELO: ht-connect.de
Sending IP: 185.118.165.225
From: info@ht-connect.de
Subject: RE:PAYMENT
Attachment: Bank details,pdf.r00 (contains "Bank details,pdf.exe")

MassLogger SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
59
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6a6814b92ba876b6f4977b0b176c87a7f5daa5bed67ac262de08742aad6c7e08/
Threat name:
Win32.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2020-07-29 06:44:13 UTC
AV detection:
18 of 29 (62.07%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=njubjojlvb3ln5expmfro3ehu725vjn62z5meyw6bb2cvllmpyea._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6a6814b92ba876b6f4977b0b176c87a7f5daa5bed67ac262de08742aad6c7e08

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

r00 6a6814b92ba876b6f4977b0b176c87a7f5daa5bed67ac262de08742aad6c7e08

(this sample)

MassLogger

Executable exe 4c8728146976e30a09321d1e158aeeb46908c54fa8614ccef7fbc9761956eca4

  
Dropping
MD5 83ec38668ed616414abf3c6e9b423acc
  
Dropping
MassLogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4c8728146976e30a09321d1e158aeeb46908c54fa8614ccef7fbc9761956eca4

Comments