MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ca144462b30d41d857bf6e92ab7970b22ec69ec6301aaeca6d114c624bebeb08. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ca144462b30d41d857bf6e92ab7970b22ec69ec6301aaeca6d114c624bebeb08
SHA3-384 hash: 317f7756aac98892b591fa48738f1e380ea5db2857690a55141fd7d11151f0cf2f76220d7b4a3024f197d277bbc92c8f
SHA1 hash: adc1cc8fb308bae8d7ffb404e0f8039cc58ee198
MD5 hash: 913b11559bcb1d4763a653741472c81e
humanhash: three-alpha-zebra-bakerloo
File name:PO No42113-No42114.rar
Download: download sample
Signature MassLogger
Create hunting rule
File size:861'279 bytes
First seen:2020-06-10 10:32:25 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 24576:gzaPx7c0IDHP+2+hkT6qj5MPCI6i1fNw8a01:saZ7evZ+hC62yaVitKl2
TLSH 3805339D50C45206FA8AEDFFF6B434AF8214EB0D26743A25848FEA1FDB4119251B2C5F
Reporter abuse_ch
Tags:MassLogger rar


Avatar
abuse_ch
Malspam distributing MassLogger:

HELO: aena.com
Sending IP: 37.49.224.134
From: Laura Esquivel Perez <lesquivel@aena.com>
Subject: New PO No42114 & No42114
Attachment: PO No42113-No42114.rar (contains "No42113-No42114.exe")

MassLogger SMTP exfil server:
mail.privateemail.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-10 10:34:09 UTC
AV detection:
18 of 31 (58.06%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zikeiyvtbva5qv57n2jkw6lqwixmnhwggank5stncfgges7l5mea._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

rar ca144462b30d41d857bf6e92ab7970b22ec69ec6301aaeca6d114c624bebeb08

(this sample)

MassLogger

Executable exe 9300260a0aa311aa5e53e3c015ba7c63bb52ccb40c9841d4f566a6019143257d

  
Dropping
MD5 f199ca0e897812a4218b91a293a7656b
  
Dropping
MassLogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9300260a0aa311aa5e53e3c015ba7c63bb52ccb40c9841d4f566a6019143257d

Comments