MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cc602ef0870ed8924eab19ab738d43ef1380e021abc732fc099718a86c306d0c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cc602ef0870ed8924eab19ab738d43ef1380e021abc732fc099718a86c306d0c
SHA3-384 hash: 06f455b50c36653c797a21c6827ce7f1ec0da90feb04f22ec5104cf67697f328b7698324f15f0a2681a1aa6eb20ba622
SHA1 hash: cb55def8b8316d1ee08c5c19a3c331439c257490
MD5 hash: 9dad8237553a6e8415274918614b6b7c
humanhash: pluto-angel-virginia-beer
File name:DHL_May 2020 at 80.6C7M490_PDF.img
Download: download sample
Signature MassLogger
Create hunting rule
File size:1'966'080 bytes
First seen:2020-06-11 13:54:34 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:3aUZH6VEt6xMQ4jawiY0ujYfUaVqJ54O9Pb2j5cPA7iYxdS8JW0K6K+:Hp6NqQ4jsdfUs4D9PbK5c3YxQo
TLSH 1C957C3A35925808C4780672C0AA9AC676F25B4536A7CB2EF1AF531B8F03B5F77521CD
Reporter abuse_ch
Tags:DHL img MassLogger


Avatar
abuse_ch
Malspam distributing MassLogger:

HELO: host6.fastpath.gr
Sending IP: 176.119.210.163
From: DHL Customer Support <noreply@dhl.com>
Subject: Re: DHL Notification / DHL_AWB_0011179303/ ETD
Attachment: DHL_May 2020 at 80.6C7M490_PDF.img (contains "DHL_May 2020 at 80.6C7M490_PDF.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.GenKryptik.EMFO.17749.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-06-11 13:56:09 UTC
AV detection:
13 of 28 (46.43%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=zrqc54ehb3mjetvldgvxhdkd54jybybbvpdtf7ajs4mkq3bqnuga._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

img cc602ef0870ed8924eab19ab738d43ef1380e021abc732fc099718a86c306d0c

(this sample)

MassLogger

Executable exe a16d191db58b4a988abfb3b12098ee3301d84a81d8feba8cb537857a573c86be

  
Dropping
MD5 0d094405e0f1c07d1af0c62c69f0feae
  
Dropping
MassLogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a16d191db58b4a988abfb3b12098ee3301d84a81d8feba8cb537857a573c86be

Comments