MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9ce196b4b4ecae98df131edcd9cb409ace105d89a6f526f13f1f7bdc3778acaa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9ce196b4b4ecae98df131edcd9cb409ace105d89a6f526f13f1f7bdc3778acaa
SHA3-384 hash: 81f9f819e3b6bb4d864b8d06a571a55f47c5ea5ef4980d5317c386eb2eea5b5a228c1bab018f46919814439acce65192
SHA1 hash: 40039e2534f4a69cc4d55acb1585d182311af640
MD5 hash: f80fff0f9b7c726fc3a9742a2745b019
humanhash: delaware-single-missouri-solar
File name:New order R.R 1808202.xz
Download: download sample
Signature MassLogger
Create hunting rule
File size:674'086 bytes
First seen:2020-08-19 14:33:57 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:QgDnPwJ3nIa2c1/lCxGAi6ZdRol/5t5IrK35/U9U49hP9xisb2OQ8eZux91Vh:QgDnPwdILcGzvdRol/5PdFun1xiw2Ose
TLSH 0BE4333B168DB63774356C61E2F4EA53E360123B8C07F623F9E55E290891DB26874F08
Reporter abuse_ch
Tags:MassLogger xz


Avatar
abuse_ch
Malspam distributing MassLogger:

HELO: svr23.internet-webhosting.com
Sending IP: 103.8.25.16
From: naim@aglfreight.com.my
Subject: New order arrangement
Attachment: New order R.R 1808202.xz (contains "New order (R.R) 1808202.exe")

MassLogger SMTP exfil server:
mail.sbrenind.com:26

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9ce196b4b4ecae98df131edcd9cb409ace105d89a6f526f13f1f7bdc3778acaa/
Threat name:
Win32.Infostealer.Maslog
Create hunting rule
Status:
Suspicious
First seen:
2020-08-19 14:35:07 UTC
AV detection:
17 of 48 (35.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ttqznnfu5sxjrxytd3onts2atlhbaxmju32sn4j7d555yn3yvsva._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9ce196b4b4ecae98df131edcd9cb409ace105d89a6f526f13f1f7bdc3778acaa

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

zip 9ce196b4b4ecae98df131edcd9cb409ace105d89a6f526f13f1f7bdc3778acaa

(this sample)

MassLogger

Executable exe a9f8d8a5503dca2d63d36e17041e6d065a6bf7bad41c000dd6d5a1e73d18d786

  
Dropping
MD5 26e0d9642410c40bc095fb579e4b2bc8
  
Dropping
MassLogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a9f8d8a5503dca2d63d36e17041e6d065a6bf7bad41c000dd6d5a1e73d18d786

Comments