MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d689a361064790952175d8e479af5bccfe980c8a6875c4ed1114eb97366f9644. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d689a361064790952175d8e479af5bccfe980c8a6875c4ed1114eb97366f9644
SHA3-384 hash: 9c3f689c5c7be90ce68e15df6b65ecbcf9a4b45ce9597e339692f11509f5da0a444f94978501744f6b51007a4385e64d
SHA1 hash: be8e23900858a4b28da4ed9693d389f290d8b5c2
MD5 hash: 02495a642b79fc0521531571cd014850
humanhash: tango-cold-steak-west
File name:Revised Invoice Climax .xz
Download: download sample
Signature MassLogger
Create hunting rule
File size:753'561 bytes
First seen:2020-08-06 06:42:43 UTC
Last seen:Never
File type: xz
MIME type:application/x-rar
ssdeep 12288:sFt6E6chSRN4ydc8kpsdZ6YzR5ldV9kx7uvQv3G+hOsI8cmiPicXdwirAHmeocu:suEYXTOM1QnOsIhmEdwiUFoz
TLSH B8F423BA18AC579DF4B24F7587B5602208259911ED970F849836EBCB2027EFF13C57A2
Reporter abuse_ch
Tags:MassLogger xz


Avatar
abuse_ch
Malspam distributing MassLogger:

From: Duncan Middlemiss <Duncan.middlemiss@premieregypt.com>
Subject: RE: Update Enquiry From CLIMAX Portable
Attachment: Revised Invoice Climax .xz (contains "Revised Invoice Climax .exe")

MassLogger SMTP exfil server:
mail.privateemail.com

Intelligence

File Origin
# of uploads :
1
# of downloads :
54
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d689a361064790952175d8e479af5bccfe980c8a6875c4ed1114eb97366f9644/
Threat name:
ByteCode-MSIL.Trojan.Skeeyah
Create hunting rule
Status:
Malicious
First seen:
2020-08-06 06:44:16 UTC
AV detection:
17 of 28 (60.71%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=22e2gyigi6ijkilv3dshtl23zt7jqdeknb24j3irctvzontpszca._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/d689a361064790952175d8e479af5bccfe980c8a6875c4ed1114eb97366f9644

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

xz d689a361064790952175d8e479af5bccfe980c8a6875c4ed1114eb97366f9644

(this sample)

MassLogger

Executable exe 9438029220db8ca0eceabb6d576917ebce7b30db2eb9ca8e52a85b089c040a9b

  
Dropping
MD5 a8ed22767227400f4fb7bf2a19b2baea
  
Dropping
MassLogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9438029220db8ca0eceabb6d576917ebce7b30db2eb9ca8e52a85b089c040a9b

Comments