MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2b50bd046daa41ac72285ed05506be51f8982c3eb6ce8ac74b3a1958fe3667fa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Intelligence File information Yara Comments

SHA256 hash: 2b50bd046daa41ac72285ed05506be51f8982c3eb6ce8ac74b3a1958fe3667fa
SHA3-384 hash: 7c238ef55142dacb3a65b65fe77c8cd4b3067e4ad4eaeb8afa5524a90ae14fd7730940c43c53224cae4470a9204768fa
SHA1 hash: 2e8f8f0c92fec5f5c1cd3b17d3b606dadee7b1a4
MD5 hash: afe38d00aaa9747fa5314098308990e1
humanhash: uranus-item-five-ink
File name:Certified check of 6500.rar
Download: download sample
Signature MassLogger
File size:963'537 bytes
First seen:2020-07-31 12:08:57 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 24576:8GSQ0cBLidx/QOqezFR84z4ue9x8Jd7yxP5tjHlyxEMaeG:8oXFy/QlSG4zfcKdO55tjFyxTi
TLSH 062523D606729B23649683B980FD69A07E203B09D20DEF5737F1DDFA16D0E1D854A0AF
Reporter @abuse_ch
Tags:MassLogger rar


Twitter
@abuse_ch
Malspam distributing MassLogger:

HELO: vip.friendtimes.net
Sending IP: 111.231.110.135
From: Barbara D. Larson <test@vip.friendtimes.net>
Reply-To: Barbara D. Larson <test@vip.friendtimes.net>
Subject: New order for item #410056077
Attachment: Certified check of 6500.rar (contains "Document#0193832.exe")

MassLogger SMTP exfil server:
mail.privateemail.com:587

Intelligence


File Origin
# of uploads :
1
# of downloads :
31
Origin country :
FR FR
Mail intelligence
Geo location:
Global
Volume:
Low
Vendor Threat Intelligence
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Status:
Malicious
First seen:
2020-07-31 12:10:13 UTC
AV detection:
18 of 48 (37.50%)
Threat level
  5/5
Threat name:
Legit
Score:
0.00

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

rar 2b50bd046daa41ac72285ed05506be51f8982c3eb6ce8ac74b3a1958fe3667fa

(this sample)

  
Dropping
MassLogger
  
Delivery method
Distributed via e-mail attachment

Comments