MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 96750076563fc2c0a20e36ae546822404c9054e698e71f95007e5a2f867880e0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 96750076563fc2c0a20e36ae546822404c9054e698e71f95007e5a2f867880e0
SHA3-384 hash: 212c3bfab414b2c390779cc85591b0d898dc3ea5dff2ab5692803fefc96c8beadbfc132447095ea7c662caafdc66f13a
SHA1 hash: 842a59af3baf6270e192c3541fff3d8dc2988a88
MD5 hash: 290738ed6beaddd5ee314988f6ad4889
humanhash: zebra-jig-nine-muppet
File name:PRODUCT SPECIFICATIONS.z
Download: download sample
Signature MassLogger
Create hunting rule
File size:847'889 bytes
First seen:2020-10-19 05:43:45 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 24576:o9sxsjOq3ALEnkabespq63s43J5wrnWzw2:KsujOqNkAey3sgC+
TLSH B605330ACD02DBC1BD910F9A737A7ACDEB60589A5FB6B09F6458DA40B6023FF950D710
Reporter cocaman
Tags:MassLogger z


Avatar
cocaman
Malicious email (T1566.001)
From: ""Eymen Mustafa" <tgifhighst@bistro.com.ph>"
Received: "from bistro.com.ph (unknown [62.113.215.195]) "
Date: "19 Oct 2020 02:11:27 +0200"
Subject: "Prime Product Concepts - Quotation Request"
Attachment: "PRODUCT SPECIFICATIONS.z"

Intelligence

File Origin
# of uploads :
1
# of downloads :
78
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/96750076563fc2c0a20e36ae546822404c9054e698e71f95007e5a2f867880e0/
Threat name:
ByteCode-MSIL.Infostealer.Stelega
Create hunting rule
Status:
Malicious
First seen:
2020-10-18 23:17:12 UTC
File Type:
Binary (Archive)
Extracted files:
4
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=sz2qa5swh7bmbiqog2xfi2bcibgjavhgtdtr7fiapznc7btyqdqa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/96750076563fc2c0a20e36ae546822404c9054e698e71f95007e5a2f867880e0

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

z 96750076563fc2c0a20e36ae546822404c9054e698e71f95007e5a2f867880e0

(this sample)

MassLogger

Executable exe 107b57fdf9c667731c973e5f254cdf985a2e7d5e6659f19aa2e9b1a0e613a7a2

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 107b57fdf9c667731c973e5f254cdf985a2e7d5e6659f19aa2e9b1a0e613a7a2
  
Dropping
MassLogger

Comments