MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 09e185c1a8eb5cdd3d506c5bc58a2f479f05c2e480b00b4191a31ebe28894ea2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 09e185c1a8eb5cdd3d506c5bc58a2f479f05c2e480b00b4191a31ebe28894ea2
SHA3-384 hash: 6876a687bda61d417025ef9a646c1e04bc5b35c33e6bacf0ad4aad70e55e0ef9c1858568bf41f431fcc3ec8bfdea1a1e
SHA1 hash: 802872b80b151d6ffaf4ea72ce985e92adf3e28e
MD5 hash: 471ff804c6170d51592796c58675bb73
humanhash: jupiter-louisiana-single-three
File name:I200623 REQUEST FOR QUOTATION.IMG
Download: download sample
Signature MassLogger
Create hunting rule
File size:1'572'864 bytes
First seen:2020-07-29 11:51:53 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 24576:paPhDtALOEDm2JeTIoW4YkS02q5Xvay2jy:MpDtHk/JSQD1
TLSH E075F159F692ED1AC3B94934E2EC1A1CCEFC85C2A227D359788696FF17C73A2D4011B1
Reporter abuse_ch
Tags:img MassLogger


Avatar
abuse_ch
Malspam distributing MassLogger:

HELO: qq.com
Sending IP: 59.36.132.42
From: maggie yu <stone_mao@morsun.com>
Subject: PO- Strong Precision I200623 REQUEST FOR QUOTATION
Attachment: I200623 REQUEST FOR QUOTATION.IMG (contains "PI10042855PDF.exe")

MassLogger SMTP exfil server:
webmail.saritatravels.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
64
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/09e185c1a8eb5cdd3d506c5bc58a2f479f05c2e480b00b4191a31ebe28894ea2/
Threat name:
ByteCode-MSIL.Trojan.MassLogger
Create hunting rule
Status:
Malicious
First seen:
2020-07-29 11:53:07 UTC
AV detection:
14 of 29 (48.28%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=bhqylqni5non2pkqnrn4lcrpi6pqlqxeqcyawqmrumpl4kejj2ra._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/09e185c1a8eb5cdd3d506c5bc58a2f479f05c2e480b00b4191a31ebe28894ea2

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

img 09e185c1a8eb5cdd3d506c5bc58a2f479f05c2e480b00b4191a31ebe28894ea2

(this sample)

MassLogger

Executable exe 55be6c73b00189e473ef23d8693ab34f8eeec82c46ed27ee5b3e88944334aaf9

  
Dropping
MD5 efaf4fa0e82360f6b9b40fbd99b606b5
  
Dropping
MassLogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 55be6c73b00189e473ef23d8693ab34f8eeec82c46ed27ee5b3e88944334aaf9

Comments