MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ce1424d27e5a98c9920c97ae6339d03172b0c5830b494e55b59c2705a92aec44. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ce1424d27e5a98c9920c97ae6339d03172b0c5830b494e55b59c2705a92aec44
SHA3-384 hash: 9dd5074fcd9cea5d2a280ad7216f98e680102a813d633e5ec0a554ea2aaa0a8d9e1c87c3fa4ac8f39ff9301d29a38f64
SHA1 hash: 25c54e3126f68699cf9fc0606a7fd95f96f86a90
MD5 hash: 5bf3c474f0fa3b8085abe1258aa4ec65
humanhash: happy-burger-texas-cardinal
File name:REQUEST FOR QUOTATION FILE.PDF.Z
Download: download sample
Signature MassLogger
Create hunting rule
File size:600'567 bytes
First seen:2020-10-11 16:36:23 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 12288:893ua7oLnW2SzPKGidQsZORIv/CaCaAgzve3bjAFs6GjSq0Z7nmHmc:8ua7oF69i2IORIv6r3gDeIFzGjNHmc
TLSH BBD4234DA71B1A55402E750CDDE2E6FE23FA91E2D1933F3DD7DC8BA203286824CA5964
Reporter abuse_ch
Tags:MassLogger z


Avatar
abuse_ch
Malspam distributing MassLogger:

HELO: webmail.cyber.net.pk
Sending IP: 203.101.175.37
From: PURCHASE DEPT <javaid@cyber.net.pk>
Subject: URGENT RFQ.
Attachment: REQUEST FOR QUOTATION FILE.PDF.Z (contains "REQUEST FOR QUOTATION FILE.exe")

MassLogger SMTP exfil server:
mail.ptautomation.com.vn:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
103
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ce1424d27e5a98c9920c97ae6339d03172b0c5830b494e55b59c2705a92aec44/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-11 15:59:07 UTC
AV detection:
5 of 48 (10.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=zykcjut6lkmmteqms6xggooqgfzlbrmdbneu4vnvtqtqlkjk5rca._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/ce1424d27e5a98c9920c97ae6339d03172b0c5830b494e55b59c2705a92aec44

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

z ce1424d27e5a98c9920c97ae6339d03172b0c5830b494e55b59c2705a92aec44

(this sample)

MassLogger

Executable exe 09d68059fed3b8a9e940eb293662b084cd4bed04b714db17baaefe1c8845458b

  
Dropping
MD5 774eb2b251d801594d926c12bd097676
  
Dropping
MassLogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 09d68059fed3b8a9e940eb293662b084cd4bed04b714db17baaefe1c8845458b

Comments