MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a9ae068f33462639db6abfd06a02d63bd712b11a6b3d52ebde25e4d402293b84. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a9ae068f33462639db6abfd06a02d63bd712b11a6b3d52ebde25e4d402293b84
SHA3-384 hash: 48671eeee8b1c58cef3845a79304f38ccedfbfaf05e8b71094346999861ba62ed1e3dc9f3aca0aee523a16658d605c7f
SHA1 hash: 1d85711ff7b0247ea5014c832a8c4660cbafbe6b
MD5 hash: 99598209f8d89b52046e996b1403dcf9
humanhash: two-hawaii-maine-hotel
File name:SWIFT_001300221547_0039948822.rar
Download: download sample
Signature MassLogger
Create hunting rule
File size:1'059'359 bytes
First seen:2020-08-04 13:20:10 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:UdSGYao70kxTpjV+oDyWsWF32RbVxHlAzylYHqPJoEdkXdYkN0pG8MGTFxAGPMZJ:KgaeV/gWEfFAFqhtk6JyKJPMZ+d0U9o
TLSH AF3533C9FB1809AF21F203FAD7165C67845EB61F2DA39DD11E6A4B2DA1EF00DD02B644
Reporter abuse_ch
Tags:Endurance MassLogger rar


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: qproxy5-pub.mail.unifiedlayer.com
Sending IP: 69.89.21.30
From: Accounts <Accounts@hsbc.de>
Reply-To: Accounts@hsbc.de
Subject: RE: Pending Payment for June and July Invoices_Compar Invoice Paid
Attachment: SWIFT_001300221547_0039948822.rar (contains "SWIFT_001300221547_0039948822.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a9ae068f33462639db6abfd06a02d63bd712b11a6b3d52ebde25e4d402293b84/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-08-04 13:22:07 UTC
AV detection:
19 of 48 (39.58%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vgxandztiytdtw3kx7iguawwhplrfmi2nm6vf266exsniarjhoca._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a9ae068f33462639db6abfd06a02d63bd712b11a6b3d52ebde25e4d402293b84

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

rar a9ae068f33462639db6abfd06a02d63bd712b11a6b3d52ebde25e4d402293b84

(this sample)

MassLogger

Executable exe 3fc0677051b6ed2a651080ba5eeb17e10d78e82f68f86c5d27a3394107b0f74e

  
Dropping
MD5 e851c9194355f1520598be2abf8bdd9b
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3fc0677051b6ed2a651080ba5eeb17e10d78e82f68f86c5d27a3394107b0f74e

Comments