MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ec1bfa97ac9477a33b0a41c906c19a2b1241a0aca492516fd049b4bb6fd33e5a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ec1bfa97ac9477a33b0a41c906c19a2b1241a0aca492516fd049b4bb6fd33e5a
SHA3-384 hash: 9096b5a55e267019800d5808fc37e903247b23f29aceab054863e0153afa9680304ab31ed08a4761d41e8d59bed24579
SHA1 hash: 75b07f0e11e24c0cd0b7000af1b2914615c2d312
MD5 hash: 1cab847cafd4d174f2c49d5a74b432be
humanhash: lamp-south-grey-foxtrot
File name:Productlist.arj
Download: download sample
Signature MassLogger
Create hunting rule
File size:849'727 bytes
First seen:2020-06-14 10:35:42 UTC
Last seen:Never
File type: arj
MIME type:application/x-rar
ssdeep 24576:5/5fh+XebLvyOAWdy//KMg2P7V0l4phgJAHy1SJ4pxQTdJRiW:5/5J+KLvS/sA7JMAS1foTPRp
TLSH 50052383B8D820DBAC4FBE17B19270C5996109BACF320DA486E25E16F057DC0D65F3B9
Reporter abuse_ch
Tags:arj MassLogger


Avatar
abuse_ch
Malspam distributing MassLogger:

HELO: gproxy1-pub.mail.unifiedlayer.com
Sending IP: 69.89.25.95
From: kavita@cciltd.in
Subject: Provide Quotation Urgently
Attachment: Productlist.arj (contains "JXbKizOnTebqBHR.exe")

MassLogger SMTP exfil server:
mail.ucfblr.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
60
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-14 10:37:05 UTC
AV detection:
18 of 31 (58.06%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=5qn7vf5msr32goykiheqnqm2fmjedifmusjfc36qjg2lw36thzna._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

arj ec1bfa97ac9477a33b0a41c906c19a2b1241a0aca492516fd049b4bb6fd33e5a

(this sample)

MassLogger

Executable exe 51dab158ab98d0a62fcd53205185424cf23ace362a5197f9b3205c8aa789a684

  
Dropping
MD5 a6ea6b8b6d7bd8f77a2b174454ab7354
  
Dropping
MassLogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 51dab158ab98d0a62fcd53205185424cf23ace362a5197f9b3205c8aa789a684

Comments