MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 915881fce735e99691067d81c8d89b624eacd2d71ef55fd202ca295e4cfacf65. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 915881fce735e99691067d81c8d89b624eacd2d71ef55fd202ca295e4cfacf65
SHA3-384 hash: 7df2a525b1e202c70591b2678f8f77c67d9ef8e2ea733fe376ff0a36629e13766a0c1e8ec7d2757bee3d441170552de2
SHA1 hash: 71347814e4492400e5526320a81030b32326b972
MD5 hash: ff58cc39fc55c3827b161f81495d89fd
humanhash: bluebird-mango-maine-oklahoma
File name:CALIDAD DE AVIOS 090720.pdf___________________________________________.gz
Download: download sample
Signature MassLogger
Create hunting rule
File size:954'093 bytes
First seen:2020-07-18 08:41:41 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 24576:1Y8qw4mi3smVcaDzVgb/hQh+b58eqBknEtaF5D9kQ:1Zw3SaDRC/LbGepEIPBP
TLSH 9B15335BE90628D8BDA5BD5FE3046AA42E7298131B2F5832756E04C621FD77C7C88F1C
Reporter abuse_ch
Tags:gz MassLogger


Avatar
abuse_ch
Malspam distributing MassLogger:

HELO: groupmail.com
Sending IP: 37.49.224.121
From: Pagos Harmony <info.glycan@groupmail.com>
Subject: PAGO 09-07-20
Attachment: CALIDAD DE AVIOS 090720.pdf___________________________________________.gz (contains "gunzipped")

MassLogger SMTP exfil server:
mail.devor.com.mx:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
79
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.LuheFihaA.32607.15294.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/915881fce735e99691067d81c8d89b624eacd2d71ef55fd202ca295e4cfacf65/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-07-18 08:43:04 UTC
AV detection:
12 of 48 (25.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=sfmid7hhgxuzneigpwa4rwe3mjhkzuwxd32v7uqcziuv4th2z5sq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/915881fce735e99691067d81c8d89b624eacd2d71ef55fd202ca295e4cfacf65

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

gz 915881fce735e99691067d81c8d89b624eacd2d71ef55fd202ca295e4cfacf65

(this sample)

MassLogger

Executable exe cc1bbef42692db18e756a3d2498f59fbfcaacaf32c38f2a4e6a5cf1a6b4c67a1

  
Dropping
MD5 f43e889a5f1ea2996c03086774406d44
  
Dropping
MassLogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 cc1bbef42692db18e756a3d2498f59fbfcaacaf32c38f2a4e6a5cf1a6b4c67a1

Comments