MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b4fc62a2055b2c4f8778f6d6e5c349194b824b7d233454dfd263ee3ef26d8d65. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b4fc62a2055b2c4f8778f6d6e5c349194b824b7d233454dfd263ee3ef26d8d65
SHA3-384 hash: 51111455f408d479a750e628508ba9d44cc29f1f898f921ace28085da83294a7394f968e88a8bc53e39c69229943fc34
SHA1 hash: 40653bc546d8fbe3a81b5f3a6a6bd05480edcb05
MD5 hash: e8ee78f8bff18ee22f3019cfdfcc7639
humanhash: quebec-oven-india-black
File name:RFQ 712020_PDF.zip
Download: download sample
Signature MassLogger
Create hunting rule
File size:689'575 bytes
First seen:2020-07-02 06:34:43 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:uRAlYFhyRkArBgjkfXDK9Mm2N3tNJUJRRijtvcGP78x7IWEhaJam3:6xA7aY2/2N3XCExcenWEgAK
TLSH CEE42362F71E26BB90632DCAE043811EE63F4B96E40ABD10A177F36023896F11EDD55D
Reporter abuse_ch
Tags:MassLogger zip


Avatar
abuse_ch
Malspam distributing MassLogger:

HELO: mail.strongmailvault.com
Sending IP: 111.90.144.215
From: Huixiang trading co., limited <office@biotast.com>
Subject: RE: 紧急 请 RFQ #712020
Attachment: RFQ 712020_PDF.zip (contains "RFQ 712020_PDF.exe")

MassLogger SMTP exfil server:
us2.smtp.mailhostbox.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.WQV.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b4fc62a2055b2c4f8778f6d6e5c349194b824b7d233454dfd263ee3ef26d8d65/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-07-02 06:36:06 UTC
AV detection:
11 of 48 (22.92%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=wt6gfiqflmwe7b3y63lolq2jdffyes35em2fjx6smpxd54tnrvsq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

zip b4fc62a2055b2c4f8778f6d6e5c349194b824b7d233454dfd263ee3ef26d8d65

(this sample)

MassLogger

Executable exe 0d46f6cd2186a84326476f3d5a76b4060889d787c92cd0aa7e77eeceb1cc05b6

  
Dropping
MD5 f1d29b76d0e3f74acfa79a39897e9403
  
Dropping
MassLogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0d46f6cd2186a84326476f3d5a76b4060889d787c92cd0aa7e77eeceb1cc05b6

Comments