MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b48e56d461f28153c8e38c6f081da6bdd33741eee4674fbb4986df0f84701e8f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b48e56d461f28153c8e38c6f081da6bdd33741eee4674fbb4986df0f84701e8f
SHA3-384 hash: 2f977dee34ab98e775d0c3922ae572bc8552f8e52fec96fad503895142ca71d678b0d63fcc48a56023cc9cfc825cfb8c
SHA1 hash: 0ede49cfa30325512e53f86b5e61fa28f780b60c
MD5 hash: 6d85b7ba1a472195f9dd845646edb5c0
humanhash: wolfram-single-eighteen-lion
File name:doc7647464.lzh
Download: download sample
Signature MassLogger
Create hunting rule
File size:772'187 bytes
First seen:2020-10-16 10:25:53 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:l98Fmec9CGM5CdSXdsJH85AMrOAb7yBho1pss89g+28QEOXehi5HDTUTmq4jjXlm:l9smePrdmH85zb7Pss8r2PEOXiqEIP1m
TLSH 69F43339675A7CFFF06A6041E79AA564B7586D3E370C12217318F2F2963928BDEE0580
Reporter abuse_ch
Tags:lzh MassLogger


Avatar
abuse_ch
Malspam distributing MassLogger:

HELO: server0.ndarr.com
Sending IP: 192.236.199.38
From: Husnul <servh@gmail.com>
Subject: PO/INV Document
Attachment: doc7647464.lzh (contains "doc7647464.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b48e56d461f28153c8e38c6f081da6bdd33741eee4674fbb4986df0f84701e8f/
Threat name:
ByteCode-MSIL.Infostealer.Stelega
Create hunting rule
Status:
Malicious
First seen:
2020-10-15 20:10:35 UTC
AV detection:
18 of 48 (37.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wshfnvdb6kavhshdrrxqqhngxxjtoqpo4rtu7o2jq3pq7bdqd2hq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
MassLogger
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b48e56d461f28153c8e38c6f081da6bdd33741eee4674fbb4986df0f84701e8f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

zip b48e56d461f28153c8e38c6f081da6bdd33741eee4674fbb4986df0f84701e8f

(this sample)

MassLogger

Executable exe c0b81523511df7b87111c6d4d849f08326e22a15adeb15a203feb8ce5ca56a75

  
Dropping
MD5 193368c56423d40d89fceb0179bc6970
  
Dropping
MassLogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c0b81523511df7b87111c6d4d849f08326e22a15adeb15a203feb8ce5ca56a75

Comments