MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 38dc64b6cae87d41bfa98cd0f95d97d0c9e91ca9e9a06fbb721150a943e0a62e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 38dc64b6cae87d41bfa98cd0f95d97d0c9e91ca9e9a06fbb721150a943e0a62e
SHA3-384 hash: 7666c675a5f7969db37b1ab6516c1bf3ab780f5526de52bf2845f68f4ed9385433992985f3cbaa348faa9ca831e88cb1
SHA1 hash: 91549cc1c9131b7b817477b816f414d48740b7c2
MD5 hash: 6a4db70f52ffee8807ae0259d2a9602d
humanhash: cola-oven-arizona-pluto
File name:DHL_JUNE DETAILS PDF.z
Download: download sample
Signature MassLogger
Create hunting rule
File size:1'110'242 bytes
First seen:2020-06-05 06:03:15 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:Zcgh3K+7RCnLglmVL0M0nvnwMrObpi9Ksg9R6J2CX67pOj:BlKsRM2eQvnF6b4zg9RYLqO
TLSH 1B3533518D3E287E278DD3C0925D2898EE827306CCE8A1D35115F05B66859FEF87BD93
Reporter abuse_ch
Tags:DHL MassLogger z


Avatar
abuse_ch
Malspam distributing MassLogger:

HELO: slot0.ceruler.com
Sending IP: 45.95.169.192
From: DHL Express International <info@ceruler.com>
Reply-To: infodhl_internation@fastservice.com
Subject: DHL Shipment Arrival Notification
Attachment: DHL_JUNE DETAILS PDF.z (contains "DHL.exe")

MassLogger SMTP exfil server:
mail.mytravelexplorer.com587

Intelligence

File Origin
# of uploads :
1
# of downloads :
60
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-06-05 04:22:37 UTC
AV detection:
19 of 48 (39.58%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=hdogjnwk5b6udp5jrtipsxmx2de6shfj5gqg7o3scfiksq7auyxa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

zip 38dc64b6cae87d41bfa98cd0f95d97d0c9e91ca9e9a06fbb721150a943e0a62e

(this sample)

MassLogger

Executable exe ac5ebcd391d6b8a015e80ec1cad293374a5a26729b475de2d93f76cb6a3cb8c4

  
Dropping
MD5 ac323e213c469608775d7c4a6f921d97
  
Dropping
MassLogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ac5ebcd391d6b8a015e80ec1cad293374a5a26729b475de2d93f76cb6a3cb8c4

Comments