MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f626bd744fe65fd63b9be04fbc5b03c4f35818c580cbfe462a1e242b971b020e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f626bd744fe65fd63b9be04fbc5b03c4f35818c580cbfe462a1e242b971b020e
SHA3-384 hash: 5dceecbd8475725f2d9a2ea21f2dac2fa591003de1c7d009b04bd5fef9355cb3da8fd9f42ee52515b20a2ca86053c99b
SHA1 hash: 4f030de045d5c6347f5b6d3427f745204d944ef4
MD5 hash: 3b262e6a84c70766f64b905dfb28d0f3
humanhash: echo-dakota-maryland-robin
File name:Payment Dcoment copy pdf.rar
Download: download sample
Signature MassLogger
Create hunting rule
File size:824'608 bytes
First seen:2020-07-31 05:51:09 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 24576:5mOYTufZOAXyYhbqIu8iOtu/yRXPOH2Aj2h5rA:2qfZPXzR1iOtu/2/OH2FE
TLSH 1D0523C47FB463A36DBD149DDA8551E80E8F4694B22F6DB275D60788493B93A07F0332
Reporter abuse_ch
Tags:MassLogger rar Yahoo


Avatar
abuse_ch
Malspam distributing MassLogger:

HELO: sonic308-10.consmr.mail.ne1.yahoo.com
Sending IP: 66.163.187.33
From: Jean Koneh <jean_koneh@ymail.com>
Subject: : Fwd: Wire Transfer Payment
Attachment: Payment Dcoment copy pdf.rar (contains "NCJJLEeBL7A6qeP.exe")

MassLogger SMTP exfil server:
smtp.yandex.ru:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
68
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f626bd744fe65fd63b9be04fbc5b03c4f35818c580cbfe462a1e242b971b020e/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-31 05:53:05 UTC
AV detection:
7 of 48 (14.58%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=6ytl25cp4zp5mo434bh3ywydytzvqggfqdf74rrkdyscxfy3aiha._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f626bd744fe65fd63b9be04fbc5b03c4f35818c580cbfe462a1e242b971b020e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

rar f626bd744fe65fd63b9be04fbc5b03c4f35818c580cbfe462a1e242b971b020e

(this sample)

MassLogger

Executable exe 96af26169543b638599cd1c9e7b236572c5cdab29c844d7e824b30f0a2cbab16

  
Dropping
MD5 324c08d81f759fda3100f9e0e29e54d0
  
Dropping
MassLogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 96af26169543b638599cd1c9e7b236572c5cdab29c844d7e824b30f0a2cbab16

Comments