MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c0d977fcf86a5f14ae431c0c12bad1dc702378f5e529ffa267867043a6c44529. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c0d977fcf86a5f14ae431c0c12bad1dc702378f5e529ffa267867043a6c44529
SHA3-384 hash: 2f5f29b79a035ed09ba6926c6605e3b5a1b6a3fd6cce70d97c9c4a247ba7f152355d11412267b9dc4d0dc931bdc409de
SHA1 hash: 38450a8b8a58f4ed792aec7bcf2540b0f18b1783
MD5 hash: f11bcee2906b3a3fbdb8d9e455ff62c4
humanhash: football-hamper-freddie-tennis
File name:NEW SPECIFICATION.rar
Download: download sample
Signature MassLogger
Create hunting rule
File size:866'459 bytes
First seen:2020-06-08 12:40:58 UTC
Last seen:2020-06-09 07:34:53 UTC
File type: rar
MIME type:application/x-rar
ssdeep 24576:yeSMmNEYnGB/nOosbgSagr5ytLkPR6K4hxQ:jfmOlmE6r0L3zxQ
TLSH 5A053376012F6B6E53904847F66CB1CBD683DB41A393BBA39CC1F7A500255C9A9C8BD3
Reporter abuse_ch
Tags:MassLogger rar


Avatar
abuse_ch
Malspam distributing MassLogger:

From: "Roman" <roman@lusakagroupbd.com>
Reply-To: "Roman" <roman@lusakagroupbd.com>
Subject: NEW ORDER SPECIFICATION
Attachment: NEW SPECIFICATION.rar (contains "NEW SPECIFICATION .exe")

MassLogger SMTP exfil server:
mail.privateemail.com:587

Intelligence

File Origin
# of uploads :
2
# of downloads :
59
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-06-08 12:42:05 UTC
AV detection:
14 of 29 (48.28%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ydmxp7hynjprjlsddqgbfowr3rycg6hv4uu77ithqzyehjweiuuq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

rar c0d977fcf86a5f14ae431c0c12bad1dc702378f5e529ffa267867043a6c44529

(this sample)

MassLogger

Executable exe f71822de24a50ca44db81e8529d59bc071ca457318dc5c4d35ce02a1ccef3b53

  
Dropping
MD5 f26f9927cac29abda7730263247dc3f4
  
Dropping
MassLogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f71822de24a50ca44db81e8529d59bc071ca457318dc5c4d35ce02a1ccef3b53

Comments