MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b18a980aeeac36c4132e5cd62bd1a66f85c74eb565baf0f5a7613de77b0c8e88. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b18a980aeeac36c4132e5cd62bd1a66f85c74eb565baf0f5a7613de77b0c8e88
SHA3-384 hash: a1e970de5f62302fce4c283e12a68b19829d1fd6225204b0a303c88abf1485d17597b6e67d208ac87501e979452b3674
SHA1 hash: b7d32151f32ef29770576a6b13dd860262b7e096
MD5 hash: 9199159e5b8610e33cf66fd64c8139db
humanhash: bluebird-mars-india-july
File name:Posco Febuary 2021 Provisional Contract_pdf.gz
Download: download sample
Signature MassLogger
Create hunting rule
File size:12'592 bytes
First seen:2021-02-24 06:56:41 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 384:uUxcXdAyGrg6AW2rLA9/mqShcM/v1nK07Ny/4wpwYU0hEl2GDXuv:TQY4r+Wh9n97Ny/4wpTPhPGyv
TLSH 5342BF82D95504BE3A9C372D84B78A8A7DDE14CC01FE9A0D4FC289F1506A132F2EAC71
Reporter abuse_ch
Tags:gz MassLogger


Avatar
abuse_ch
Malspam distributing MassLogger:

HELO: box.vertym.xyz
Sending IP: 64.227.1.193
From: Sakulrat Tavornkaew <Kongkawoot@oryx.com>
Subject: Posco February 2021 Provisional Contract
Attachment: Posco Febuary 2021 Provisional Contract_pdf.gz (contains "GTS_21_9018_ORDER_pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
114
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27382.Rar5Heur.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b18a980aeeac36c4132e5cd62bd1a66f85c74eb565baf0f5a7613de77b0c8e88/
Threat name:
Win32.Downloader.BaseLoader
Create hunting rule
Status:
Malicious
First seen:
2021-02-24 06:57:08 UTC
AV detection:
12 of 46 (26.09%)
Threat level:
  3/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=wgfjqcxovq3miezoltlcxungn6c4otvvmw5pb5nhme66o6ymr2ea._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

gz b18a980aeeac36c4132e5cd62bd1a66f85c74eb565baf0f5a7613de77b0c8e88

(this sample)

MassLogger

Executable exe 1e17f40e9221c60fa2516f0c59806053a35cf826a1f305502425bf7349e120f4

  
Dropping
MD5 d9dc20ba3c5255b2a81cdcc44e9b1e44
  
Dropping
MassLogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1e17f40e9221c60fa2516f0c59806053a35cf826a1f305502425bf7349e120f4

Comments