MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 86ff203a923278bd15b5bd1b28caff03d9adf8ce2d8f9ffce68ebc9909a83df6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 86ff203a923278bd15b5bd1b28caff03d9adf8ce2d8f9ffce68ebc9909a83df6
SHA3-384 hash: 952d05515fe9a06472aeb283889ceebd1edb09fa289853daa4ec2f0e353d8be7c236bf851805c5bc9ace31bc97cd7bf7
SHA1 hash: 3522e3c884e3c15712c3082900185a7954f9fa50
MD5 hash: f3c5074fd6a34616c89dea90ed70c346
humanhash: apart-blue-march-coffee
File name:42800.rar
Download: download sample
Signature MassLogger
Create hunting rule
File size:1'223'040 bytes
First seen:2020-10-23 11:39:36 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 24576:S0NHU9RuDGw2GTohnifR25ZYSnYpmalVAnUTv9QpuBHUF+UjASZ:1NHUGqmTo40hnYIad5UMMZ
TLSH F54533FA30B48DB930BB34A0AD6CC1AF991527C9DAB194C814675503696E30B5FDBFB0
Reporter abuse_ch
Tags:GarantiBBVA geo MassLogger rar TUR


Avatar
abuse_ch
Malspam distributing MassLogger:

HELO: m1mkyc5j.ni.net.tr
Sending IP: 89.252.168.58
From: Garanti BBVA Emeklilik <OtomatikBES@garantibbvaemeklilik.com.tr>
Reply-To: noreply <mintchin1@gmail.com>
Subject: Otomatik BES İşlemleri Son Aşama - Ödeme Dosyanızı Yükleyin
Attachment: 42800.rar (contains "TJKjGvC3dP2CIDi.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
107
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Heur.31279.17023.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/86ff203a923278bd15b5bd1b28caff03d9adf8ce2d8f9ffce68ebc9909a83df6/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2020-10-23 10:10:52 UTC
AV detection:
2 of 48 (4.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=q37saousgj4l2fnvxunsrsx7apm236gofwhz77hgr26jscnihx3a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
MassLogger
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/86ff203a923278bd15b5bd1b28caff03d9adf8ce2d8f9ffce68ebc9909a83df6

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

rar 86ff203a923278bd15b5bd1b28caff03d9adf8ce2d8f9ffce68ebc9909a83df6

(this sample)

MassLogger

Executable exe 9e184fecd3e0be67e11c78d407fe8e1f5f75573b32801bf00055745ef3c86225

  
Dropping
MD5 024ca03cfeb3ccac67e8516ad12b896d
  
Dropping
MassLogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9e184fecd3e0be67e11c78d407fe8e1f5f75573b32801bf00055745ef3c86225

Comments