MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a1b9229ef6e1efa2731d6da0bf50d3b99dae4fa6ccc7323d4a20c88f3ae0146b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a1b9229ef6e1efa2731d6da0bf50d3b99dae4fa6ccc7323d4a20c88f3ae0146b
SHA3-384 hash: be68f5e3512892179b6716331678899afcd71edc268ee26df5ab00915ce17bd78625146297e8b76b8193333f9e7c7b7a
SHA1 hash: e66a69ec57697a3ed1902149a2100cf816186441
MD5 hash: a336fc6741d88106c5883001721626ff
humanhash: zebra-chicken-thirteen-mexico
File name:POs-282020.rar
Download: download sample
Signature MassLogger
Create hunting rule
File size:1'100'924 bytes
First seen:2020-08-04 07:44:03 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 24576:/qHorqL64ndqChnPl5mDyaA1Zwb/3/zBy8BKQ/dP2H7CXJyx6iIbo:/BOLFsCHkDyaYwb/1jBwH7aE6iIs
TLSH 273533BB2BF176BF4156E6954BC6237A29C540700FE1352A9E4ACC343C868D7A6CD24F
Reporter abuse_ch
Tags:MassLogger rar


Avatar
abuse_ch
Malspam distributing MassLogger:

HELO: hal-lndia.co.in
Sending IP: 5.188.93.228
From: "Michael Smith " <sales@hal-lndia.co.in>
Subject: FW:PURCHASE ORDER
Attachment: POs-282020.rar (contains "PO's-282020.exe")

MassLogger SMTP exfil server:
smtp.yandex.com.tr:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a1b9229ef6e1efa2731d6da0bf50d3b99dae4fa6ccc7323d4a20c88f3ae0146b/
Threat name:
ByteCode-MSIL.Trojan.Pwsx
Create hunting rule
Status:
Malicious
First seen:
2020-08-04 07:45:08 UTC
AV detection:
7 of 48 (14.58%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ug4sfhxw4hx2e4y5nwql6ugtxgo24t5gztdtepkkedei6oxacrvq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/a1b9229ef6e1efa2731d6da0bf50d3b99dae4fa6ccc7323d4a20c88f3ae0146b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

rar a1b9229ef6e1efa2731d6da0bf50d3b99dae4fa6ccc7323d4a20c88f3ae0146b

(this sample)

MassLogger

Executable exe 0b0537b9f976c4a49f1105bc03d252c0cac7a99b9abdb1a020d2966b6a0b1285

  
Dropping
MD5 c6ee03f38ee45f360ec0b06050c43b7b
  
Dropping
MassLogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0b0537b9f976c4a49f1105bc03d252c0cac7a99b9abdb1a020d2966b6a0b1285

Comments