MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8bce24cd3a61fdc8020922dcb840a8d107fdf2f096e3ed51ec24ba26f1876d97. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8bce24cd3a61fdc8020922dcb840a8d107fdf2f096e3ed51ec24ba26f1876d97
SHA3-384 hash: f02c4a665b206861086324ae53e550f68dbef7d675ca40e7f48bf1a41d0dc7fadf7cc66da3f77a35e92408cf86cbc8bc
SHA1 hash: 1a187cc941a67eb36436bc87f986fa2cb4e879cb
MD5 hash: 6fd925a12326b4830def92d09794df29
humanhash: seven-lactose-delaware-table
File name:invoice09090999-Pdf.z
Download: download sample
Signature MassLogger
Create hunting rule
File size:781'262 bytes
First seen:2020-05-20 12:05:28 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:yG6oFDYAKhjZunqlk1TdhZMV7O0P7jP/nWTKAkuS30CMN4SWEKnYOhKKhcX8DAHo:y1oFDYAUt3lQphL0nfvA032NnKYN+csv
TLSH 03F423EE00FD32DA62B23B3D5940E6CA1801DA8525D79F8D111AF7C849CED9E781BED4
Reporter abuse_ch
Tags:MassLogger TNT z


Avatar
abuse_ch
Malspam distributing MassLogger:

HELO: mail.huclangia.gq
Sending IP: 64.52.173.52
From: TNT Express <tntadmin@huclangia.gq>
Reply-To: admin1.invoice@tnt.com
Subject: Invoicing Order#
Attachment: invoice09090999-Pdf.z (contains "invoice#09090999-Pdf.exe")

MassLogger SMTP exfil server:
mail.ereglitso.org.tr:587

MassLogger SMTP exfil email address:
hulya.torum@ereglitso.org.tr

Intelligence

File Origin
# of uploads :
1
# of downloads :
81
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.23810.ZipHeur.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.22771.ZipHeur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-20 12:34:05 UTC
File Type:
Binary (Archive)
Extracted files:
4
AV detection:
21 of 47 (44.68%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=rphcjtj2mh64qaqjelolqqfi2ed734xqs3r62upmes5cn4mhnwlq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

zip 8bce24cd3a61fdc8020922dcb840a8d107fdf2f096e3ed51ec24ba26f1876d97

(this sample)

MassLogger

Executable exe 5756414989427044652d411548d7523b88c74449101d277d0b227a00c8526bc3

  
Dropping
MD5 e50d7a2c0d596398300327210298636b
  
Dropping
MassLogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 5756414989427044652d411548d7523b88c74449101d277d0b227a00c8526bc3

Comments