MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a9d59ec565a4366c28f42e00f76f2c0d795be7be6aa937e64ed3feab5328174b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a9d59ec565a4366c28f42e00f76f2c0d795be7be6aa937e64ed3feab5328174b
SHA3-384 hash: 0496aacf24ad97ae42e61290362d98e5356d00e0e7a599e88bdbc5812cd980db997628f99bd768d7d4e69ac72c65e8a6
SHA1 hash: 3474855b1794a666a12265c408f2505140e3f017
MD5 hash: a279a5b59cff5c09cc12e48ee57721a8
humanhash: romeo-football-jersey-violet
File name:Dekont 1.r00
Download: download sample
Signature MassLogger
Create hunting rule
File size:779'749 bytes
First seen:2020-08-04 13:38:47 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:XSJ+h0p73+7H0HwqSKtukRckYC1ktuzsgfnPuHAF5t5uxG35zubUA3fdunyQXUaF:XQs0pRHwHgYmktlyuHu5PR18ROVUaOi
TLSH FDF42364B70F64155A5404178AF8BFDBC4A0176B1872121BEFF6E0AC23106EE65B2FBD
Reporter abuse_ch
Tags:MassLogger r00


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: rdns0.fineceramic.cyou
Sending IP: 104.168.158.234
From: Halkbank Mobil Şubesi <block59@fineceramic.cyou>
Subject: 04.8.2020 TARIHLI HESABA EFT DEKONTU
Attachment: Dekont 1.r00 (contains "Dekont.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
72
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Generic.mg.1ba7ee7b1f0e03c2.18986.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a9d59ec565a4366c28f42e00f76f2c0d795be7be6aa937e64ed3feab5328174b/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-08-04 13:40:09 UTC
AV detection:
3 of 48 (6.25%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vhkz5rlfuq3gykhufyapo3zmbv4vxz56nkutpzso2p7kwuzic5fq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.97
Link:
https://yomi.yoroi.company/submissions/a9d59ec565a4366c28f42e00f76f2c0d795be7be6aa937e64ed3feab5328174b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

zip a9d59ec565a4366c28f42e00f76f2c0d795be7be6aa937e64ed3feab5328174b

(this sample)

MassLogger

Executable exe ac42965215afb055c4135cc87288be3f2aaff848972634fbaed4c365e112af43

  
Dropping
MD5 1ba7ee7b1f0e03c2b63e828b4eb1158e
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ac42965215afb055c4135cc87288be3f2aaff848972634fbaed4c365e112af43

Comments