MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 487966ac27957cffaab676f739a0928f87a9dab944c275cad3550d3760b42ae2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 487966ac27957cffaab676f739a0928f87a9dab944c275cad3550d3760b42ae2
SHA3-384 hash: dc259e2d1ef6b3db81ce28fde8efb25e1e6ba6672d085e6d91b7a5e8ce065a64fed7f443d60af8642a14d8b6a3d39696
SHA1 hash: bc55924b3584a7e34e955b9d710f465b4df00297
MD5 hash: 1e57d49e066643e833ca5aa01c1afdf6
humanhash: skylark-bluebird-lactose-nuts
File name:Invio Estratto.CAB
Download: download sample
Signature MassLogger
Create hunting rule
File size:764'735 bytes
First seen:2020-05-22 10:08:31 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:QtDxhA9DMcE+PI1kfUToTY8m8EGB7Euiornelg3by6V+oS+kFI57BWlB:mw9BvMqurhornelg3by6V+oSp25NMB
TLSH D2F433E56E9A20EBBB7805214CD3853A8C675E97C1C3312C35246AE9C93EBDE8F05749
Reporter abuse_ch
Tags:cab MassLogger


Avatar
abuse_ch
Malspam distributing MassLogger:

HELO: cloudhost-143971.us-west-1.nxcli.net
Sending IP: 173.249.144.86
From: GLS BARI <bari@gls-italy.com>
Subject: Invio Estratto Conto
Attachment: Invio Estratto.CAB (contains "Invio Estratto.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.UCB.22051.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-22 10:36:54 UTC
File Type:
Binary (Archive)
Extracted files:
4
AV detection:
13 of 48 (27.08%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

zip 487966ac27957cffaab676f739a0928f87a9dab944c275cad3550d3760b42ae2

(this sample)

MassLogger

Executable exe 0bf96baeec569010dc7acb82cd5f2bb7feacd9c5411dcd6d8fd53c9b316344ce

  
Dropping
MD5 41eeb21fde2e0191d466f6ac5f75b4b3
  
Dropping
MassLogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0bf96baeec569010dc7acb82cd5f2bb7feacd9c5411dcd6d8fd53c9b316344ce

Comments