MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a01bc8c3c2b23bb4fa0d6dc408d718acce32b42db2c1c723c760297a3da067ab. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a01bc8c3c2b23bb4fa0d6dc408d718acce32b42db2c1c723c760297a3da067ab
SHA3-384 hash: 502c26d5173d9f6944a324644f5f1534edff2a0952feb1ca9ab9ef84457f4704c32372bc7c851cbc3945b0cff6773e7e
SHA1 hash: 5df58adfdd6b7be401a8b0f5410494ccd8afba9b
MD5 hash: e07bbf01ebf8753774b40814c29e601a
humanhash: freddie-double-west-orange
File name:Request for Quotation N0. 2005744.gz
Download: download sample
Signature MassLogger
Create hunting rule
File size:820'254 bytes
First seen:2020-06-24 08:27:46 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 12288:26ahc/gTQZqrgnlhldmT2dLyVoFBlWqFyDbz5DHxJWTYhCw0xRcqQAXq:26w9QZqr8lhd0i/FyDH5DHO0Yc/Qq
TLSH D305339350AAC8FAB93DA397CD53F3F1F9331D561669830E81A0263D31E9D63329906D
Reporter abuse_ch
Tags:gz MassLogger


Avatar
abuse_ch
Malspam distributing MassLogger:

HELO: asia.com
Sending IP: 185.222.57.136
From: unileversupply@asia.com
Subject: REQUEST FOR QUOTATION
Attachment: Request for Quotation N0. 2005744.gz (contains "Request for Quotation N0. 2005744.exe")

MassLogger SMTP exfil server:
mail.drngetu.co.za:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a01bc8c3c2b23bb4fa0d6dc408d718acce32b42db2c1c723c760297a3da067ab/
Threat name:
ByteCode-MSIL.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-06-24 08:29:04 UTC
AV detection:
28 of 48 (58.33%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=uan4rq6cwi53j6qnnxcarvyyvthdfnbnwla4oi6hmauxupnam6vq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

gz a01bc8c3c2b23bb4fa0d6dc408d718acce32b42db2c1c723c760297a3da067ab

(this sample)

MassLogger

Executable exe f54e2a18f9a6b1f5fa144306a9ad3e277e0dfa581543c5156a6a59b644c913da

  
Dropping
MD5 5f7b0769ecc70adc2b32c6916050d4ab
  
Dropping
MassLogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f54e2a18f9a6b1f5fa144306a9ad3e277e0dfa581543c5156a6a59b644c913da

Comments