MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 792634a0252e8f1347eb97eed5417937627392a5ca0d1fdfaa92efa4b37f2725. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 792634a0252e8f1347eb97eed5417937627392a5ca0d1fdfaa92efa4b37f2725
SHA3-384 hash: ba058c8eccee55fd92c0b9ac15238849f01e4e90eec4f3d721546e68ec4f62862a2120d06d230a84d0dd341d29e25b56
SHA1 hash: e9cd985620c6c0a58b2e4e0b98bcb7c14913de92
MD5 hash: b90db9c72601836a69af3a1b1c37922c
humanhash: helium-avocado-carolina-rugby
File name:V2020.003976 - RS LINE 3905 - 2_pdf.gz
Download: download sample
Signature MassLogger
Create hunting rule
File size:578'475 bytes
First seen:2020-11-20 07:53:00 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 12288:IFMsOADR0tjKIq0o/faXNwuSk5teCYIA1NBNxu+b6eEEof:AgA2tdq0maXeBk5dA1DNxux9
TLSH 1DC423D21BAE8A9F1632FC19800065E61CBB80961DA390F56C985594F5CF7ECBDE08BD
Reporter abuse_ch
Tags:gz MassLogger


Avatar
abuse_ch
Malspam distributing MassLogger:

HELO: riig.ingent.net
Sending IP: 5.9.127.248
From: David Orbeladze <info@harnnett.es>
Subject: RS LINE LTD New Order
Attachment: V2020.003976 - RS LINE 3905 - 2_pdf.gz (contains "Ejgvvuwuu8.exe")

MassLogger SMTP exfil server:
bh-58.webhostbox.net:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
116
Origin country :
n/a
Vendor Threat Intelligence
Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/792634a0252e8f1347eb97eed5417937627392a5ca0d1fdfaa92efa4b37f2725/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-11-20 02:14:39 UTC
AV detection:
15 of 29 (51.72%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=petdjibff2hrgr7ls7xnkqlzg5rhhevfzigr7x5kslx2jm37e4sq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

gz 792634a0252e8f1347eb97eed5417937627392a5ca0d1fdfaa92efa4b37f2725

(this sample)

MassLogger

Executable exe 13f0c6e6a5c9f192c09a6e3a3768e8e31548b04a6839b28731862707c2689ac2

  
Dropping
MD5 08d0909ef8f0adc051fde2154d65b2c5
  
Dropping
MassLogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 13f0c6e6a5c9f192c09a6e3a3768e8e31548b04a6839b28731862707c2689ac2

Comments