MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c13cd0110d56dd9d336d9d94f918d9d66807ea822e535a0d7517d2353b838629. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c13cd0110d56dd9d336d9d94f918d9d66807ea822e535a0d7517d2353b838629
SHA3-384 hash: 6822a9122ca3dfb38cbc4ffd2aa583474e9ea3a32cb9b0d46249a439264ff92a76f7d9a4385f033fcd5c93c0084e73c2
SHA1 hash: 5303961ac66cc865d7b4eafb8be03b0038bb3c5b
MD5 hash: 0ce7f8318e261b5937d608c55b957ed9
humanhash: coffee-river-crazy-montana
File name:PaymentCopy..gz
Download: download sample
Signature MassLogger
Create hunting rule
File size:857'439 bytes
First seen:2020-06-08 06:18:54 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 24576:KMiuAO0JYvj2vHD0g09z7LNO4snQoiFdjM31gV:4h2Svj0PiudwlgV
TLSH 24053318D18A2410951B2DB8B34D08631EB9F483EF9D2EFE9CD0753ADE7A961C9E4743
Reporter abuse_ch
Tags:gz MassLogger SCB


Avatar
abuse_ch
Malspam distributing MassLogger:

HELO: serve0.manteuffel.pw
Sending IP: 173.82.95.199
From: Standard Chartered Bank<hr@manteuffel.pw>
Reply-To: alauddiinns@gmail.com
Subject: Your beneficiary adice from Standard Chartered branch/subsidiary
Attachment: PaymentCopy..gz (contains "PaymentCopy.exe")

MassLogger SMTP exfil server:
mail.ucfblr.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
59
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-06-08 06:20:08 UTC
AV detection:
19 of 31 (61.29%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ye6naeink3oz2m3ntwkpsggz2zuap2ucfzjvudlvc7jdko4dqyuq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

gz c13cd0110d56dd9d336d9d94f918d9d66807ea822e535a0d7517d2353b838629

(this sample)

MassLogger

Executable exe fcb07f6be2f0675c3631617fa46649f6edb9d8fc55d09fdfaee9f9c4dd577ce9

  
Dropping
MD5 10cc0074ed3ccfd7588521f9264e56ed
  
Dropping
MassLogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 fcb07f6be2f0675c3631617fa46649f6edb9d8fc55d09fdfaee9f9c4dd577ce9

Comments