MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6b4df6d71447049ad7800e21b4a64025d57531268620d1bd1b95cd18b5255396. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6b4df6d71447049ad7800e21b4a64025d57531268620d1bd1b95cd18b5255396
SHA3-384 hash: 3157a10bd0500319ec18fe703b7c5c8beaa141b0ed3714c9a003876fdaf465153538b22943a95ba9722bb00670b5254b
SHA1 hash: 521fc99a3bab77090a139589edb7b174b6b1430f
MD5 hash: d5720e50cec769c1b2f6da37422e655d
humanhash: skylark-avocado-louisiana-autumn
File name:30123846927364867364.r00
Download: download sample
Signature MassLogger
Create hunting rule
File size:951'398 bytes
First seen:2020-10-13 05:48:50 UTC
Last seen:Never
File type: r00
MIME type:application/x-rar
ssdeep 24576:OtDcO4PaxFFG/EznpFXZpUhESJQCugwJ3aFAGBBBkq:OtSPaxq8PwhESiLd30xXaq
TLSH BF15232EFDC8957516AB305ED98027985374FBEC8E029ED4CC6890A3CDB9DC6273458B
Reporter abuse_ch
Tags:MassLogger r00


Avatar
abuse_ch
Malspam distributing MassLogger:

HELO: ffc-international.com
Sending IP: 156.96.62.59
From: Candy Tao (陶培芹) <ngb.danae@ffc-international.com>
Reply-To: 'Candy Tao (陶培芹)' <michal.swaitczesci@gmail.com>
Subject: Re: Order Confirmation
Attachment: 30123846927364867364.r00 (contains "30123846927364867364.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
81
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6b4df6d71447049ad7800e21b4a64025d57531268620d1bd1b95cd18b5255396/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-13 05:27:49 UTC
File Type:
Binary (Archive)
Extracted files:
13
AV detection:
13 of 29 (44.83%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=nng7nvyui4cjvv4abyq3jjsaexkxkmjgqyqndpi3sxgrrnjfkola._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
MassLogger
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6b4df6d71447049ad7800e21b4a64025d57531268620d1bd1b95cd18b5255396

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

r00 6b4df6d71447049ad7800e21b4a64025d57531268620d1bd1b95cd18b5255396

(this sample)

MassLogger

Executable exe 08c7131cac4c6c62004d8b2e3ce0b85d1b35e7325f753a865206814cd87ecdf4

  
Dropping
MD5 1f564c6344943585be15f7f1168d84f0
  
Dropping
MassLogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 08c7131cac4c6c62004d8b2e3ce0b85d1b35e7325f753a865206814cd87ecdf4

Comments