MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c6c0c3425cc63e8aa79c7928bb2ab109a509f9e742b052640d1527483259c610. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c6c0c3425cc63e8aa79c7928bb2ab109a509f9e742b052640d1527483259c610
SHA3-384 hash: b4e3f7df27d8f92d8c89a74b717ad5d52fbd8d313d008f38fc46ac29a0de0e23336c803ddb287e0724366adafd921fdf
SHA1 hash: d72f5523ff55b666ba8a9e1256614bf0efebaa4a
MD5 hash: bca3780a418e8f6df382737aa2f7a920
humanhash: oven-fifteen-lamp-skylark
File name:Boleta de pago 0005102002 20.07.2020.7z
Download: download sample
Signature MassLogger
Create hunting rule
File size:964'588 bytes
First seen:2020-07-20 07:18:51 UTC
Last seen:Never
File type: 7z
MIME type:application/x-rar
ssdeep 24576:kfiP6oOz8aQxeer5U/05qXa97QheYZnULAvIBSHs:kM6oOAaQxeera/C97AZUmIwHs
TLSH 4525336A6F437367EEA7F742367DC8D203B25D73E28D1802C987B90B71549A01B25BD2
Reporter abuse_ch
Tags:7z MassLogger


Avatar
abuse_ch
Malspam distributing MassLogger:

HELO: cetinturkbilgisayar.com
Sending IP: 213.142.138.130
From: Jhonny Sarmiento <jhonnysarmiento@gmail.com>
Subject: Boleta de pago 20.07.2020
Attachment: Boleta de pago 0005102002 20.07.2020.7z (contains "Boleta de pago 0005102002 20.07.2020.exe")

MassLogger FTP exfil server:
ftp.antares-group.ro:21

Intelligence

File Origin
# of uploads :
1
# of downloads :
74
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c6c0c3425cc63e8aa79c7928bb2ab109a509f9e742b052640d1527483259c610/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-07-20 07:20:09 UTC
AV detection:
20 of 48 (41.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=y3amgqs4yy7ivj44peulwkvrbgsqt6phikyfezancutuqmszyyia._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c6c0c3425cc63e8aa79c7928bb2ab109a509f9e742b052640d1527483259c610

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

7z c6c0c3425cc63e8aa79c7928bb2ab109a509f9e742b052640d1527483259c610

(this sample)

MassLogger

Executable exe 8301f6519bb8ff7d7e82797452fb636b6d54df6c5cbfa4d7b98cb1db38e5b754

  
Dropping
MD5 72a421fcc48f74dadfa2795a6ed14def
  
Dropping
MassLogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8301f6519bb8ff7d7e82797452fb636b6d54df6c5cbfa4d7b98cb1db38e5b754

Comments