MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a0a8e5e5532866af56b141da8d96c4baa8f1f0809b7176546f53c6e26c32238b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a0a8e5e5532866af56b141da8d96c4baa8f1f0809b7176546f53c6e26c32238b
SHA3-384 hash: d726247d1866d6f62ce32b7ef08a20b4015144f4063825c15859fc84031a4fafb834031818d767242a312e21dd4a051b
SHA1 hash: ba9b601740aa8c1dda846aeb39e3a534e54ad8d8
MD5 hash: 4067b429e6051f6624c27a2e0f4ce103
humanhash: robert-bluebird-triple-video
File name:IMG_000924677656765_0025676544.Doc.z
Download: download sample
Signature MassLogger
Create hunting rule
File size:525'126 bytes
First seen:2020-10-09 06:29:53 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 12288:qYka2ReQQ+2YydYJBBcV49aqDQVvNwNqCQTls0R56ARWAi3SiGN+Y:qEtQjkABWV41aQUZs0R5X83S1L
TLSH 62B423267FEB38208CF00CE9E7D692E830DD4EB71C8851E555A2B5B76604C8D7588EDB
Reporter abuse_ch
Tags:MassLogger z


Avatar
abuse_ch
Malspam distributing MassLogger:

HELO: webmail.cyber.net.pk
Sending IP: 203.101.175.37
From: SONJAFLECTH BERGER <dml@cyber.net.pk>
Subject: RFQ
Attachment: IMG_000924677656765_0025676544.Doc.z (contains "IMG_000924677656765_0025676544.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
81
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a0a8e5e5532866af56b141da8d96c4baa8f1f0809b7176546f53c6e26c32238b/
Threat name:
ByteCode-MSIL.Infostealer.Stelega
Create hunting rule
Status:
Malicious
First seen:
2020-10-09 01:57:26 UTC
AV detection:
13 of 48 (27.08%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ucuolzktfbtk6vvrihni3fwexkupd4eatnyxmvdpkpdoe3bseofq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/a0a8e5e5532866af56b141da8d96c4baa8f1f0809b7176546f53c6e26c32238b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

z a0a8e5e5532866af56b141da8d96c4baa8f1f0809b7176546f53c6e26c32238b

(this sample)

MassLogger

Executable exe 401b953b523b658a53f5da322b332176946c201d1b2f99c0cdc19f9c77cef0bc

  
Dropping
MD5 ec46b1c50dec1119b99b3210c5c21094
  
Dropping
MassLogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 401b953b523b658a53f5da322b332176946c201d1b2f99c0cdc19f9c77cef0bc

Comments