MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a5e16f52aecbd84b4897d739f23b0ab3adb32bc43e508b79a537df00549ca2df. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a5e16f52aecbd84b4897d739f23b0ab3adb32bc43e508b79a537df00549ca2df
SHA3-384 hash: 3868ec193e426ac47f7c23cf1ecce4ffa4e5b7117896f0a91c4593478d0a5f100955ec6262d5a3dd0667637de5708a57
SHA1 hash: 18a10e9d83897b976a16a0248a2402b964c92229
MD5 hash: 1b248bbd1b577441942c6443ffe7c82a
humanhash: mobile-failed-july-wisconsin
File name:Migliore consulenza globale sui pagamenti PI CFL002 19A.gz
Download: download sample
Signature MassLogger
Create hunting rule
File size:935'275 bytes
First seen:2020-08-07 13:26:51 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:ZDWcERZshLnx0seKqZx1ib2XPr3amfpVCPoDiWRQ6/qSIiUD4jgKtAYxFqYaK6bY:ZLAceZxR3xhmGCaq8UD4NZFqa+qUKD
TLSH 751533D03240AE82DB771A53F7F17C725F2926B70488B28F7B97B5A10B3568019729ED
Reporter abuse_ch
Tags:geo gz ITA MassLogger


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: allianz.it
Sending IP: 95.211.208.25
From: Cristina Sasso <cristina.sasso@allianz.it>
Subject: Migliore consulenza globale sui pagamenti // PI # CFL002 / 19A
Attachment: Migliore consulenza globale sui pagamenti PI CFL002 19A.gz (contains "Migliore consulenza globale sui pagamenti PI # CFL002 19A.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a5e16f52aecbd84b4897d739f23b0ab3adb32bc43e508b79a537df00549ca2df/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-08-07 13:28:11 UTC
AV detection:
20 of 29 (68.97%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=uxqw6uvozpmewsex2447eoykwow3gk6ehziiw6nfg7pqave4ulpq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.45
Link:
https://yomi.yoroi.company/submissions/a5e16f52aecbd84b4897d739f23b0ab3adb32bc43e508b79a537df00549ca2df

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

zip a5e16f52aecbd84b4897d739f23b0ab3adb32bc43e508b79a537df00549ca2df

(this sample)

MassLogger

Executable exe 1872a9eaa84a2a54125c3d8e5196f998808f808942c69192340e731a58ff971f

  
Dropping
MD5 9c2453b22e9e215094d90a25303ae8d2
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1872a9eaa84a2a54125c3d8e5196f998808f808942c69192340e731a58ff971f

Comments