MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f42ea9493de598a50adbf61158d5c92c8119264031065c56c6bdc80a214b10f3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f42ea9493de598a50adbf61158d5c92c8119264031065c56c6bdc80a214b10f3
SHA3-384 hash: bcdcfd2843f58169414eb0dc259614f8ef9eadf5757d00d48d9e68f36751aa71055ab97b797ad738c9ce26ee5faabda4
SHA1 hash: b1310e5024ac3bf795bd8001c17dbb911f8ddc75
MD5 hash: c5456333188d15551a847a3048a24496
humanhash: three-hot-seventeen-december
File name:006020i.z
Download: download sample
Signature MassLogger
Create hunting rule
File size:826'062 bytes
First seen:2020-06-18 09:45:13 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 12288:jI9boW8ydsv77JHqjr7hAp3FKeUxn5lCL6Ll/Bl8is1u5jf1DxXQ09wMbr:02zxe7SdFxy71B5l8is1uB19Xllbr
TLSH 130533DBA7B57C606773022BD6C7152C6EBADF0F43A23BADE04C6438D92E8101F52656
Reporter abuse_ch
Tags:MassLogger z


Avatar
abuse_ch
Malspam distributing MassLogger:

HELO: smtp-out32.welcomeitalia.it
Sending IP: 46.44.253.76
From: info@gfe.it
Subject: RE: RFQ:GFE-20-00620
Attachment: 006020i.z (contains "006020i.exe")

MassLogger SMTP exfil server:
mail.saritatravels.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
72
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Infostealer.BitStealer
Create hunting rule
Status:
Malicious
First seen:
2020-06-18 10:37:39 UTC
AV detection:
19 of 31 (61.29%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=6qxkssj54wmkkcw36yivrvojfsarsjsagedfyvwgxxeauiklcdzq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

z f42ea9493de598a50adbf61158d5c92c8119264031065c56c6bdc80a214b10f3

(this sample)

MassLogger

Executable exe ef1399c83707929a9b0a89f121646af56a94d1165abb314f618f83e395889169

  
Dropping
MD5 5f285cd9cf4f1806a38f27a0e083da00
  
Dropping
MassLogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ef1399c83707929a9b0a89f121646af56a94d1165abb314f618f83e395889169

Comments