MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ef3a705d92f5919949be18024d4ff6f88a4717b707bdf598fb0cac25dc7ab49c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ef3a705d92f5919949be18024d4ff6f88a4717b707bdf598fb0cac25dc7ab49c
SHA3-384 hash: 981e02dc02e4c86bd963b4a4b9830b78171edd27ba69be9346756fdf97ed800faf21028ac4d30bc881203922aec7b8ba
SHA1 hash: d548b5b4cae9a56e9f869ca5b9ec8e15add9faef
MD5 hash: ad1e00710b6412d78c1e3eae5416b811
humanhash: nebraska-triple-robert-virginia
File name:ZZW00008112020ZD1_DPILpdf.zip
Download: download sample
Signature MassLogger
Create hunting rule
File size:828'957 bytes
First seen:2020-08-11 10:53:51 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:nfAMKGtXgfHJL2tjkBsXiqEa3OpfsuvqFPzzYY:nYMKagfHJUjBiqEaKfsJFd
TLSH 1A05330D461266B13F32C8DA6DFD5C44EA7E8CCE782C9493B3BB7E0845D416065B8BDA
Reporter abuse_ch
Tags:MassLogger zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: vps.i4kp.com
Sending IP: 144.217.14.232
From: Bartosz Bazia <sklad.brno@betosan.cz>
Subject: New purchase order Cellfast - ZZW/00011/06/2020/ZD1_DPIL
Attachment: ZZW00008112020ZD1_DPILpdf.zip (contains "ZZW00008112020ZD1_DPILpdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.CIL.HeapOverride.Heur.19717.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ef3a705d92f5919949be18024d4ff6f88a4717b707bdf598fb0cac25dc7ab49c/
Threat name:
ByteCode-MSIL.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-08-11 10:55:11 UTC
AV detection:
9 of 48 (18.75%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=545haxms6wizssn6dabe2t7w7cfeof5xa667lgh3bswclxd2wsoa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.66
Link:
https://yomi.yoroi.company/submissions/ef3a705d92f5919949be18024d4ff6f88a4717b707bdf598fb0cac25dc7ab49c

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

zip ef3a705d92f5919949be18024d4ff6f88a4717b707bdf598fb0cac25dc7ab49c

(this sample)

MassLogger

Executable exe f1ce8a3c72d7e45300b38de923c0ad45c466ef17a44bec4aad85a4672690eb22

  
Dropping
MD5 a556bc0ce0bcf11af90c5405f3aa9067
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f1ce8a3c72d7e45300b38de923c0ad45c466ef17a44bec4aad85a4672690eb22

Comments