MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2b50bd046daa41ac72285ed05506be51f8982c3eb6ce8ac74b3a1958fe3667fa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2b50bd046daa41ac72285ed05506be51f8982c3eb6ce8ac74b3a1958fe3667fa
SHA3-384 hash: 7c238ef55142dacb3a65b65fe77c8cd4b3067e4ad4eaeb8afa5524a90ae14fd7730940c43c53224cae4470a9204768fa
SHA1 hash: 2e8f8f0c92fec5f5c1cd3b17d3b606dadee7b1a4
MD5 hash: afe38d00aaa9747fa5314098308990e1
humanhash: uranus-item-five-ink
File name:Certified check of 6500.rar
Download: download sample
Signature MassLogger
Create hunting rule
File size:963'537 bytes
First seen:2020-07-31 12:08:57 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 24576:8GSQ0cBLidx/QOqezFR84z4ue9x8Jd7yxP5tjHlyxEMaeG:8oXFy/QlSG4zfcKdO55tjFyxTi
TLSH 062523D606729B23649683B980FD69A07E203B09D20DEF5737F1DDFA16D0E1D854A0AF
Reporter abuse_ch
Tags:MassLogger rar


Avatar
abuse_ch
Malspam distributing MassLogger:

HELO: vip.friendtimes.net
Sending IP: 111.231.110.135
From: Barbara D. Larson <test@vip.friendtimes.net>
Reply-To: Barbara D. Larson <test@vip.friendtimes.net>
Subject: New order for item #410056077
Attachment: Certified check of 6500.rar (contains "Document#0193832.exe")

MassLogger SMTP exfil server:
mail.privateemail.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
70
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2b50bd046daa41ac72285ed05506be51f8982c3eb6ce8ac74b3a1958fe3667fa/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-07-31 12:10:13 UTC
AV detection:
18 of 48 (37.50%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=fnil2bdnvja2y4ril3ifkbv6kh4jqlb6w3hivr2lhimvr7rwm75a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/2b50bd046daa41ac72285ed05506be51f8982c3eb6ce8ac74b3a1958fe3667fa

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

rar 2b50bd046daa41ac72285ed05506be51f8982c3eb6ce8ac74b3a1958fe3667fa

(this sample)

MassLogger

Executable exe bcd7372fd84fe78e97a72a842df6cab2a5d7a47909a3fd05b13f6f4990de8a7f

  
Dropping
MD5 97edaeff8f726e10d554f8f8f5aad7ae
  
Dropping
MassLogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 bcd7372fd84fe78e97a72a842df6cab2a5d7a47909a3fd05b13f6f4990de8a7f

Comments