MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b584ec4e83d86ec542e16aed27f3e826685e10d50aac1943d76e57f335b97936. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b584ec4e83d86ec542e16aed27f3e826685e10d50aac1943d76e57f335b97936
SHA3-384 hash: de9f06f3a1a7aaed8714a457adbd5cf2ab7040515c4368b85b6fe875156eb760ec078f3faf7d51da25d9ddb981dcfc15
SHA1 hash: 9e695b0fbfe389e9d392c3da778ccefc143228a7
MD5 hash: f6e789620bcbc78f2f1f4ed6e3afc819
humanhash: india-emma-avocado-thirteen
File name:REQUEST FOR QUOTATION pdf.zip
Download: download sample
Signature MassLogger
Create hunting rule
File size:931'825 bytes
First seen:2020-10-12 06:25:53 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:CgjQ/Z8Pnh7mCMRMmbm4xfoEo7vuCGDH3xDPBw:U/Z8J7mVDbm5vt21Bw
TLSH BA153335E24429DAB91577217702716E69E0EB331D80CF7AE462ED776B31F2A024F90D
Reporter abuse_ch
Tags:MassLogger zip


Avatar
abuse_ch
Malspam distributing MassLogger:

HELO: server.wesaca.com
Sending IP: 185.62.136.211
From: bkj <bkj@cbn.net.id>
Subject: Request for Quote (RFQ)
Attachment: REQUEST FOR QUOTATION pdf.zip (contains "REQUEST FOR QUOTATION pdf.exe")

MassLogger SMTP exfil server:
smtp.goldenfance.com:587

MassLogger SMTP exfil email address:
ppdata@goldenfance.com

Intelligence

File Origin
# of uploads :
1
# of downloads :
79
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b584ec4e83d86ec542e16aed27f3e826685e10d50aac1943d76e57f335b97936/
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=wwcoytud3bxmkqxbnlwsp47iezuf4egvbkwbsq6xnzl7gnnzpe3a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b584ec4e83d86ec542e16aed27f3e826685e10d50aac1943d76e57f335b97936

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

zip b584ec4e83d86ec542e16aed27f3e826685e10d50aac1943d76e57f335b97936

(this sample)

MassLogger

Executable exe 43ba2b908ebb74bc0f85adc1ea07e9a56075cbfd805502f886bd1a51da714bdd

  
Dropping
MD5 1fa2da684708dca4a1cf876d12557ce3
  
Dropping
MassLogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 43ba2b908ebb74bc0f85adc1ea07e9a56075cbfd805502f886bd1a51da714bdd

Comments