MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d00c00ee39c2f7a87db1c7d238df43c9d71b26c2588f4e335165c5cd67c5094d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d00c00ee39c2f7a87db1c7d238df43c9d71b26c2588f4e335165c5cd67c5094d
SHA3-384 hash: 6616b2704748f3535e3664ba524c8d2479560b0864ee563983cd4dd7c78535a31a1608fc51c77155f84a9c10f905a4ba
SHA1 hash: fc6bb39c74071ed32e6aad19bfafabd511cafb69
MD5 hash: fcbf99ca44a7475deda156f70e502283
humanhash: music-purple-mango-ten
File name:Required and purchase plan 000029300.PDF.R00
Download: download sample
Signature MassLogger
Create hunting rule
File size:956'144 bytes
First seen:2020-08-17 06:14:04 UTC
Last seen:Never
File type: r00
MIME type:application/x-rar
ssdeep 24576:vk1ArQRjXyGM422YCWi7ocWYDz+yBdZ93fP8:fQRjudUWi0cWg+2Bk
TLSH D41533D3077020571C350F22F36DA29DEA166429FA520276D5AB9EB7D17A20F07AACC6
Reporter abuse_ch
Tags:MassLogger r00


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: vip.126.com
Sending IP: 199.96.83.20
From: Fendi_Qyresearch<fendi_research@vip.126.com>
Subject: REQUEST QUOTATION FOR OCTOBER 2020
Attachment: Required and purchase plan 000029300.PDF.R00 (contains "Required and purchase plan 000029300.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
55
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d00c00ee39c2f7a87db1c7d238df43c9d71b26c2588f4e335165c5cd67c5094d/
Threat name:
Win32.Trojan.Ymacco
Create hunting rule
Status:
Malicious
First seen:
2020-08-17 06:15:06 UTC
AV detection:
17 of 48 (35.42%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2agab3rzyl32q7nry7jdrx2dzhlrwjwclchu4m2rmxc42z6fbfgq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/d00c00ee39c2f7a87db1c7d238df43c9d71b26c2588f4e335165c5cd67c5094d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

r00 d00c00ee39c2f7a87db1c7d238df43c9d71b26c2588f4e335165c5cd67c5094d

(this sample)

MassLogger

Executable exe cbca1b2ee6c097f73a866a102f4f17a5966ede96d69b51d6702a0882181fa866

  
Dropping
MD5 71005666acb0710d2f81555dacfcd87d
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 cbca1b2ee6c097f73a866a102f4f17a5966ede96d69b51d6702a0882181fa866

Comments