MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fc838efc10c0a6b53ad9ad166e47b161d9682e0a339ffd62e2bef7e4d3313050. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Intelligence File information Yara Comments

SHA256 hash: fc838efc10c0a6b53ad9ad166e47b161d9682e0a339ffd62e2bef7e4d3313050
SHA3-384 hash: bf598ddf0551d5786ffd2203f84de4c0bd3cef02441b49386ce8d9e41ab17c4ebd0179aa345dc73a9ff3cd2804e99d02
SHA1 hash: 58ada8728374ff6cebff05a6c188b929df8febe8
MD5 hash: aad33677f99bd1a842eedee6e25b4012
humanhash: solar-october-oranges-sodium
File name:PO38562110.gz
Download: download sample
Signature MassLogger
File size:840'855 bytes
First seen:2020-07-31 12:12:22 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 24576:QuMJvLZ8NdoffIhzOO62lIqerF4NwYnLBWm:QuM0NKQhzltIqeZApBWm
TLSH 590533A8EA4BE258998D97E750D5F40850C7922A37837E206CB39B25483FFD35D30D9B
Reporter @abuse_ch
Tags:gz MassLogger


Twitter
@abuse_ch
Malspam distributing MassLogger:

HELO: server.accountpdd.life
Sending IP: 89.41.26.168
From: Cheong Siew<test@msaratco.com>
Subject: New Order / PO38562110
Attachment: PO38562110.gz (contains "gunzipped")

MassLogger C2:
http://visionmoneymantra.com/os/panel/

Intelligence


File Origin
# of uploads :
1
# of downloads :
32
Origin country :
FR FR
Mail intelligence
Geo location:
Global
Volume:
Low
Vendor Threat Intelligence
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Status:
Malicious
First seen:
2020-07-31 12:14:07 UTC
AV detection:
24 of 48 (50.00%)
Threat level
  5/5
Threat name:
Suspicious File
Score:
0.45

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

gz fc838efc10c0a6b53ad9ad166e47b161d9682e0a339ffd62e2bef7e4d3313050

(this sample)

  
Dropping
MassLogger
  
Delivery method
Distributed via e-mail attachment

Comments