MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ffb124dc9dd321e46919e19d04bc22181a0c472d7fbcbeae9add0c04b967bc2b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ffb124dc9dd321e46919e19d04bc22181a0c472d7fbcbeae9add0c04b967bc2b
SHA3-384 hash: 72e61b51fafb4cae8d5a7b3adeac7c81cb16f1a073b7fb05d4fb1225a76b01526274580d0ed6046940bbb4ca1f8dfe70
SHA1 hash: be41894dcd2c82965eb4c35eed108c10eb7a1be5
MD5 hash: 92d1aa75951dec641a56346d266c8089
humanhash: eleven-missouri-pip-apart
File name:200102093201_21072020.7z
Download: download sample
Signature MassLogger
Create hunting rule
File size:944'776 bytes
First seen:2020-07-21 06:58:42 UTC
Last seen:Never
File type: 7z
MIME type:application/x-rar
ssdeep 24576:5dCwo0GRHjAyD8G1Ks/q+HRdUbfRaRzS8hpWCCSmJ:nC4Sjw0KwxHzUjRaZRhp5DmJ
TLSH 0B1533CE959B7FE1C14AA3D1CAEF18AED5B10E202A1FEC28EF54D0BC6125C6584744E7
Reporter abuse_ch
Tags:7z MassLogger


Avatar
abuse_ch
Malspam distributing MassLogger:

HELO: ripper1.x-logix.pt
Sending IP: 176.61.147.243
From: Prasert Yoovidhya <prasertyoovidhya@gmail.com>
Subject: 200102093201_21072020
Attachment: 200102093201_21072020.7z (contains "200102093201_21072020.exe")

MassLogger FTP exfil server:
ftp.antares-group.ro:21

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ffb124dc9dd321e46919e19d04bc22181a0c472d7fbcbeae9add0c04b967bc2b/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-21 07:00:09 UTC
AV detection:
15 of 29 (51.72%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=76ysjxe52mq6i2iz4goqjpbcdanayrznp66l5lu23ugajolhxqvq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ffb124dc9dd321e46919e19d04bc22181a0c472d7fbcbeae9add0c04b967bc2b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

7z ffb124dc9dd321e46919e19d04bc22181a0c472d7fbcbeae9add0c04b967bc2b

(this sample)

MassLogger

Executable exe b9a0302982b161ed64592d925e0c7bbd9813f27d0c0bf0db9115c91e53005a34

  
Dropping
MD5 55d80064b5e8d143293301dce7e178c7
  
Dropping
MassLogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b9a0302982b161ed64592d925e0c7bbd9813f27d0c0bf0db9115c91e53005a34

Comments