MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5024d7052a08cb4612a33edbadd6cfb5f52699dd0e3f77f86bd1aeb751f8fad2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5024d7052a08cb4612a33edbadd6cfb5f52699dd0e3f77f86bd1aeb751f8fad2
SHA3-384 hash: 1d39a8c6c9d943bcd3292d9e27f85fb66d05f329e47efa832b25f5b4d96cbc519948914a0d019e596ce5fd1b42cff17e
SHA1 hash: 95e7093f49d2e462394013da03228ef265e29713
MD5 hash: a389e6c1383812a2222d986823223a3a
humanhash: arkansas-golf-cold-carpet
File name:PO7562201.gz
Download: download sample
Signature MassLogger
Create hunting rule
File size:808'569 bytes
First seen:2020-08-05 12:09:46 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 12288:fllp1auNHjYzhgih0jJ2hHtacnQ/+OzW901qcfiKXNhDnC92LS5qs83YolkgWLt:quBqhR/hNacnqztfPLS43X2gY
TLSH F105230AC21EE7710758E1AB6902BDB0E16E01DCB7705CF7411B509AD4F0A95FAAD78F
Reporter abuse_ch
Tags:gz MassLogger


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: server.accountpdd.life
Sending IP: 89.41.26.168
From: Qing <johncarlos@proradiocomm.com>
Subject: Re :Re :New Order PO7562201
Attachment: PO7562201.gz (contains "PO7562201.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
60
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Mal.DrodGzip-A.12815.10309.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5024d7052a08cb4612a33edbadd6cfb5f52699dd0e3f77f86bd1aeb751f8fad2/
Threat name:
ByteCode-MSIL.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2020-08-05 12:11:11 UTC
AV detection:
19 of 27 (70.37%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=kasnobjkbdfumevdh3n23vwpwx2sngo5by7xp6dl2gxloupy7lja._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5024d7052a08cb4612a33edbadd6cfb5f52699dd0e3f77f86bd1aeb751f8fad2

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

gz 5024d7052a08cb4612a33edbadd6cfb5f52699dd0e3f77f86bd1aeb751f8fad2

(this sample)

MassLogger

Executable exe ef30ffc2d3ba3ec27cfaee6dd4e86f0fa4e2c8799e341affa924e0763d51ed1a

  
Dropping
MD5 cd43c1409987ea30440112f44b07038a
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ef30ffc2d3ba3ec27cfaee6dd4e86f0fa4e2c8799e341affa924e0763d51ed1a

Comments