MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8a712e075049fbd77d7e36ee80c2edacebdd963096bc580a1b814b4030834b4e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8a712e075049fbd77d7e36ee80c2edacebdd963096bc580a1b814b4030834b4e
SHA3-384 hash: 3e2377d4ab2631cde6168f6769e42f91fb85550c9062dcdaa2e9ae86daa34931bbd4475ac46eff321a27329a8e4e1569
SHA1 hash: 1e771f17f09b490988de30a535648a78240f9357
MD5 hash: 7ba304502a4e0ff24fb2ffd8b73b173e
humanhash: uniform-table-uranus-coffee
File name:RFQ_NEW029287652267.PF.Z
Download: download sample
Signature MassLogger
Create hunting rule
File size:2'552'579 bytes
First seen:2020-11-05 09:21:52 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 49152:kX3nBRBmm3rVRrkfGQ789SdiyDW4v0r3wlKtfVwIdhkULPYqs:mnfBm6rVRrkdQFu9sRfVwIdxLgqs
TLSH C5C5337B01E16E99D7D9C8CEECCF9E3857A41914796061427E48E328B2F6E693FDE040
Reporter abuse_ch
Tags:MassLogger z


Avatar
abuse_ch
Malspam distributing MassLogger:

HELO: mailvitel.vietwave.vn
Sending IP: 115.84.182.194
From: PURCHASE DEPT <lethanhmyanh@metal-art.vn>
Subject: NEW RFQ FROM DAMSON GROUP
Attachment: RFQ_NEW029287652267.PF.Z (contains "RFQ_NEW029287652267.exe")

ModiLogger SMTP exfil server:
mail.ladophar.com.vn:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
71
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8a712e075049fbd77d7e36ee80c2edacebdd963096bc580a1b814b4030834b4e/
Threat name:
ByteCode-MSIL.Trojan.SmartAssembly
Create hunting rule
Status:
Malicious
First seen:
2020-11-05 00:53:54 UTC
AV detection:
13 of 48 (27.08%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=rjys4b2qjh55o7l6g3xibqxnvtv53frqs26fqcq3qffuamedjnha._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

z 8a712e075049fbd77d7e36ee80c2edacebdd963096bc580a1b814b4030834b4e

(this sample)

MassLogger

Executable exe 29b6e9dc84ddd5436cde4f23d65ffbaecb0c853cbe79133883a1e1e867c0a220

  
Dropping
MD5 bb8fe497fc12fe51c2abe4d90ccbe47d
  
Dropping
MassLogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 29b6e9dc84ddd5436cde4f23d65ffbaecb0c853cbe79133883a1e1e867c0a220

Comments