MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 881d2f8fe7713d912b9624a73e95cd253c307798b5f13efbde7bdbd38dee6068. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 881d2f8fe7713d912b9624a73e95cd253c307798b5f13efbde7bdbd38dee6068
SHA3-384 hash: 511ca84f57e4fc215604702ba5bcf22e49e718a71a7bd4696d951e4991240a545b609c5b90687d105602e376d17a953d
SHA1 hash: 0ec01c2d514e5d687ec7c9c3fc74a3f9faca5e4c
MD5 hash: ca9fbecd39699549f0ea00ed68540692
humanhash: avocado-louisiana-illinois-single
File name:DHL_AWBTracking.rar
Download: download sample
Signature MassLogger
Create hunting rule
File size:853'983 bytes
First seen:2020-06-06 09:24:32 UTC
Last seen:2020-06-06 14:26:20 UTC
File type: rar
MIME type:application/x-rar
ssdeep 24576:Q8sHPH+dD8gpy/Lq4klSc112txXY/zy05:6vCy/GfH1A1Y7l
TLSH CD0533060B84F7B57835299C4889B144C36DA809FDC5CF7AEE89339D2B8716CA9CBC75
Reporter abuse_ch
Tags:DHL MassLogger rar


Avatar
abuse_ch
Malspam distributing MassLogger:

HELO: srv1.demspor.com
Sending IP: 31.169.94.221
From: DHL Express <dhlSender@dhl.com>
Subject: DHL AWB#Tracking_7611252994 Confirmation
Attachment: DHL_AWBTracking.rar (contains "DHL_AWB#Tracking.exe")

MassLogger SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
3
# of downloads :
67
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-06 09:26:06 UTC
AV detection:
17 of 31 (54.84%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=raos7d7hoe6zck4westt5foneu6da54ywxyt5666ppn5hdpombua._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

rar 881d2f8fe7713d912b9624a73e95cd253c307798b5f13efbde7bdbd38dee6068

(this sample)

MassLogger

Executable exe fea29955349c7f4aaf2ea1e18e1d366a643e2ed98706b168a909e45b633b4f10

  
Dropping
MD5 32d037fbe63918a29392c3cd65b112d8
  
Dropping
MassLogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 fea29955349c7f4aaf2ea1e18e1d366a643e2ed98706b168a909e45b633b4f10

Comments