MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ba8ad394d1f2035b5b582c9d1094141c283d3379a51c5a69ac7fc6118d81824f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ba8ad394d1f2035b5b582c9d1094141c283d3379a51c5a69ac7fc6118d81824f
SHA3-384 hash: 54aec25e68371ab5492f2e636cad25a78c1b3af7692714975360517bd1d0a9ef8648e7295000472bd14e2899d3468f62
SHA1 hash: d3459b2deb952a4ad1ea972d2ef2bd0c625ffa9b
MD5 hash: be265979afaa3c7cb663b4003e7f3f73
humanhash: aspen-emma-stream-sierra
File name:PROJECT RFQ.rar
Download: download sample
Signature MassLogger
Create hunting rule
File size:725'144 bytes
First seen:2020-11-19 06:35:19 UTC
Last seen:2020-11-20 06:33:38 UTC
File type: rar
MIME type:application/x-rar
ssdeep 12288:wPal68dA9IZGRBxXrxYZYe7NygOkWHWMFp8ANH5yql:L0cGprx0YeJtOkajH5yql
TLSH 2DF4231CA2D9FD34E3278013BB6DC97866E06AC69283D4FF5A5B4033E9D7067C46581B
Reporter abuse_ch
Tags:MassLogger rar


Avatar
abuse_ch
Malspam distributing MassLogger:

HELO: elmehad.com
Sending IP: 154.127.53.42
From: Baiju Rajan <aliabualnaja@elmehad.com>
Reply-To: gk@aquaflor.ae
Subject: Abu Dhabi Government,for Dualization, Engineering, Procurement and Construction of the Abu Dhabi and topside facilities (LOT 17)MLE Boosting PJ / Abu Dhabi.
Attachment: PROJECT RFQ.rar (contains "PROJECT RFQ.exe")

Intelligence

File Origin
# of uploads :
2
# of downloads :
83
Origin country :
n/a
Vendor Threat Intelligence
Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ba8ad394d1f2035b5b582c9d1094141c283d3379a51c5a69ac7fc6118d81824f/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-11-19 06:36:05 UTC
File Type:
Binary (Archive)
Extracted files:
5
AV detection:
32 of 48 (66.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=xkfnhfgr6ibvww2yfsorbfaudqud2m3zuuofu2nmp7dbddmbqjhq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

rar ba8ad394d1f2035b5b582c9d1094141c283d3379a51c5a69ac7fc6118d81824f

(this sample)

MassLogger

Executable exe 5b32ffc4c10114b55115da9f2c6e4ee22222f5d305552daf00a287b82d66c9dc

  
Dropping
MD5 edb9ce3fb683ac12c72ce836dfcdb6a0
  
Dropping
MassLogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 5b32ffc4c10114b55115da9f2c6e4ee22222f5d305552daf00a287b82d66c9dc

Comments