MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4ec753e5cafab6f687a4cda65a4509d3ecf15d4ea1bbd990e671ed00d66cbb8f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4ec753e5cafab6f687a4cda65a4509d3ecf15d4ea1bbd990e671ed00d66cbb8f
SHA3-384 hash: b99c3a6f872815b029f77293e6a6ddcc63d35e33c235366b948af423d4827e61e2974782cacf09105d08a6ab5d446913
SHA1 hash: 0beceaec37e1cc92fb4b394c6f96c5c39b4ce882
MD5 hash: 1b726e496f818e33c96f6f1f3467baff
humanhash: freddie-mississippi-high-white
File name:DHL Shipment 7348255141.zip
Download: download sample
Signature MassLogger
Create hunting rule
File size:836'341 bytes
First seen:2020-08-12 06:55:50 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:oYRM4ER8ic1yRyDMWRYor0xrfwkuHkKepCSwBl:oYRM4ERtc1y4MIr0tqcmn
TLSH 7105332B1009791DC1392A7880AC865DD8F909F1BBA14442E3BFD6DF09DBFB0F6E6654
Reporter abuse_ch
Tags:DHL MassLogger zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: oliphaunt.gmikenma.com
Sending IP: 199.58.179.120
From: DHL Express <dhl.receipt@industralmail.com>
Subject: DHL Shipment Notification: 7348255141.
Attachment: DHL Shipment 7348255141.zip (contains "DHL Shipment 7348255141.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.ArtemisEC1721EF86C0.10227.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4ec753e5cafab6f687a4cda65a4509d3ecf15d4ea1bbd990e671ed00d66cbb8f/
Threat name:
ByteCode-MSIL.Trojan.CryptInject
Create hunting rule
Status:
Malicious
First seen:
2020-08-12 06:57:06 UTC
AV detection:
10 of 47 (21.28%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=j3dvhzok7k3pnb5ezwtfurij2pwpcxkoug55tehgohwqbvtmxohq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4ec753e5cafab6f687a4cda65a4509d3ecf15d4ea1bbd990e671ed00d66cbb8f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

zip 4ec753e5cafab6f687a4cda65a4509d3ecf15d4ea1bbd990e671ed00d66cbb8f

(this sample)

MassLogger

Executable exe c3678d87151b21e6a29ded035522c1c22950f97787e45b3df2dba52a4e688c97

  
Dropping
MD5 ec1721ef86c0f91cb52081731624f00b
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c3678d87151b21e6a29ded035522c1c22950f97787e45b3df2dba52a4e688c97

Comments