MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bb7049e442b1d84dfc771e66b5d7912b494ea6b944d93239ffc1c1aa7c3fc42d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bb7049e442b1d84dfc771e66b5d7912b494ea6b944d93239ffc1c1aa7c3fc42d
SHA3-384 hash: f71996dc0b40b3480054c96deced45b27e4e995b08549c7f55a4f9ff23c312adc37504452c728ade648eb2dbe5f9eab7
SHA1 hash: 48d38d60097f04f837fb3e25918a72d954d3f139
MD5 hash: 24573a194376c8da5b13583f568fa980
humanhash: ack-comet-missouri-zulu
File name:EUROSWIFT_CONFIRMATION 1.pdf .gz
Download: download sample
Signature MassLogger
Create hunting rule
File size:1'043'534 bytes
First seen:2020-10-12 05:56:25 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 24576:BglLXegoZRUyl0BPjLG6GKFgzmcuc3+fjkfvDkeot:BMegPJVj5GSvc+bubkn
TLSH ED2533902E6CB3FD4567F989308F6CB0A3ECB649D53F9A715F318012A52DA1A4A744CF
Reporter abuse_ch
Tags:gz MassLogger


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: server.nigrc.com
Sending IP: 188.225.36.143
From: Accounts Payable NZ <accountpayablenz@nigrc.com>
Subject: Accounts Payable NZ shared a file with you
Attachment: EUROSWIFT_CONFIRMATION 1.pdf .gz (contains "EUROSWIFT_CONFIRMATION 1.pdf .exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
75
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bb7049e442b1d84dfc771e66b5d7912b494ea6b944d93239ffc1c1aa7c3fc42d/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-10-12 03:15:33 UTC
AV detection:
7 of 48 (14.58%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xnyetzccwhme37dxdztllv4rfneu5jvzitmteop7yha2u7b7yqwq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/bb7049e442b1d84dfc771e66b5d7912b494ea6b944d93239ffc1c1aa7c3fc42d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

gz bb7049e442b1d84dfc771e66b5d7912b494ea6b944d93239ffc1c1aa7c3fc42d

(this sample)

MassLogger

Executable exe 434a27cd76f2c267f301de39d0a5a30b6fb3f3b21c273645743e9da16ea51489

  
Dropping
MD5 7443fcc564fc3310b29327ac59e51c5e
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 434a27cd76f2c267f301de39d0a5a30b6fb3f3b21c273645743e9da16ea51489

Comments