MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 99d4d18e906e44d3b08aede8237928a7a6866378516bd07695f2bca4fc8a954f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 99d4d18e906e44d3b08aede8237928a7a6866378516bd07695f2bca4fc8a954f
SHA3-384 hash: 35cedb81cc04cfaeff3116a998b89ec8fb663441175b4ca63e60c1e2428f61efc71c6116d6ac5acd3eeff8854c056ffb
SHA1 hash: 647ce597bc8e8924e2dace60101323d8859d704e
MD5 hash: 86105e7e57650439248e8ac3c1e8ffac
humanhash: lithium-vegan-oregon-stairway
File name:RFQ PC00056942.zip
Download: download sample
Signature MassLogger
Create hunting rule
File size:1'059'286 bytes
First seen:2020-06-30 06:41:24 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:d65LRIkTCFD3NwDCA0C2Hc/ddMjULDdtcCF9KiX:dcrTQy+A0Z2rXLBttF9f
TLSH D3353342CDC3393C50F631959DF87B8F69B0B4CD2CAF646AE8C8DB0819F659AD143689
Reporter abuse_ch
Tags:MassLogger zip


Avatar
abuse_ch
Malspam distributing MassLogger:

HELO: smtpout2.majordomo.ru
Sending IP: 78.108.80.156
From: aleshina@interpromtechnika.ru
Subject: New order PC00056942-OA3463-12
Attachment: RFQ PC00056942.zip (contains "TECHNICAL SHEET.exe")

MassLogger SMTP exfil server:
mail.mkontakt.az:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
68
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.GenKryptik.ENGK.190.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/99d4d18e906e44d3b08aede8237928a7a6866378516bd07695f2bca4fc8a954f/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-06-30 06:43:05 UTC
AV detection:
19 of 48 (39.58%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=thkndduqnzcnhmek5xucg6jiu6timy3ykfv5a5uv6k6kj7eksvhq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

zip 99d4d18e906e44d3b08aede8237928a7a6866378516bd07695f2bca4fc8a954f

(this sample)

MassLogger

Executable exe d02c315a42a4a452a9e78011fbcce66f9f53bab788513d1b6f52e8fc70aa9f3c

  
Dropping
MD5 55126f1115a5e05fadd9d0f097273809
  
Dropping
MassLogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d02c315a42a4a452a9e78011fbcce66f9f53bab788513d1b6f52e8fc70aa9f3c

Comments