MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bf3024a0851044837a102a3eb45be38db8b5c8cb85de0cace2242937a038ccfb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bf3024a0851044837a102a3eb45be38db8b5c8cb85de0cace2242937a038ccfb
SHA3-384 hash: 1b74b9bb7a79c18f0e2232db1b15e97436998b4d360589f46c5eca5896521907b8d654de78facc5bbe55b1266f4df552
SHA1 hash: 619866ce4e0faf7856f7f0ad8df2bf1458827489
MD5 hash: 5bf237bfab876afa7fa9e8685516b507
humanhash: happy-zulu-william-lemon
File name:Επιβεβαίωση παραγγελίας του online franking σας.zip
Download: download sample
Signature MassLogger
Create hunting rule
File size:600'156 bytes
First seen:2020-08-11 13:42:03 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:bQIapF+6StS6m0hYYh7FfmOcRGjrl3OFOVQiwcowEYQR8Z41f7UFFkjbo+DeJMR:k7ytS6PBFf8RGvl3OPiwcMYQR8qkQ0+D
TLSH 6AD42369131210AC373E611F167248CA59E4F97BC21E8B7643EBDBEBF8359681483772
Reporter abuse_ch
Tags:DHL geo GRC MassLogger zip


Avatar
abuse_ch
Malspam distributing MassLogger:

HELO: email.guellconsulting.com
Sending IP: 46.183.115.211
From: DHL GREECE <ljiljana.stehec@gmail.com>
Subject: DB_DHL_AWB_39902761 / AD Επιβεβαίωση
Attachment: Επιβεβαίωση παραγγελίας του online franking σας.zip (contains "Επιβεβαίωση παραγγελίας του online franking σας.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
57
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bf3024a0851044837a102a3eb45be38db8b5c8cb85de0cace2242937a038ccfb/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-08-11 13:43:06 UTC
AV detection:
9 of 48 (18.75%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=x4ycjiefcbcig6qqfi7liw7drw4llsglqxpazlhcequtpibyzt5q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/bf3024a0851044837a102a3eb45be38db8b5c8cb85de0cace2242937a038ccfb

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

zip bf3024a0851044837a102a3eb45be38db8b5c8cb85de0cace2242937a038ccfb

(this sample)

MassLogger

Executable exe a8a2e34c6f491ba5d0f16899835630257c0124249fd1d0852b27e736b2a98b3d

  
Dropping
MD5 5eecf03b05db7688aeaa9e53815f92fd
  
Dropping
MassLogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a8a2e34c6f491ba5d0f16899835630257c0124249fd1d0852b27e736b2a98b3d

Comments