MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ff9f73c57d1cf21e73311761d6ab69e59782bc63f3254a5f04e541b492beb3ba. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ff9f73c57d1cf21e73311761d6ab69e59782bc63f3254a5f04e541b492beb3ba
SHA3-384 hash: d3f897d4af4bd805130326a4176246ea3faafda068261eaa0be1d0af1403e6193331900aab93ea3231278153a9085c75
SHA1 hash: 5f8599b4ef9eb931ac595373e7961e18c097fca8
MD5 hash: 430b1a59d711169c7b0ebdbe17b0124f
humanhash: hawaii-sierra-arkansas-delaware
File name:Q2020-07-466am.iso
Download: download sample
Signature MassLogger
Create hunting rule
File size:1'503'232 bytes
First seen:2020-07-31 10:16:16 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:yHX8kTaa4C/vW/R7h2Iq2oJUadK0RXgJ3ukGHN5uKyOtTiZfhz:yHLTEJ9rqUozRlkGLuKyYTQ
TLSH EC65293E38834514C969463580289AC1BAE1A74B3B62CB5DE1EF134F5F03B6B7B560DE
Reporter abuse_ch
Tags:iso MassLogger


Avatar
abuse_ch
Malspam distributing MassLogger:

HELO: mexportools.mx
Sending IP: 37.49.230.253
From: Eduardo Malato <eduardo.malato@mexportools.mx>
Subject: RE: Q2020-07-466am
Attachment: Q2020-07-466am.iso (contains "Q2020-07-466am.exe")

MassLogger SMTP exfil server:
mail.privateemail.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
70
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Generic.mg.93a02efc3319e408.32245.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ff9f73c57d1cf21e73311761d6ab69e59782bc63f3254a5f04e541b492beb3ba/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-07-31 10:18:07 UTC
AV detection:
14 of 48 (29.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=76pxhrl5dtzb44zrc5q5nk3j4wlyfpdd6msuuxye4va3jev6wo5a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/ff9f73c57d1cf21e73311761d6ab69e59782bc63f3254a5f04e541b492beb3ba

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

iso ff9f73c57d1cf21e73311761d6ab69e59782bc63f3254a5f04e541b492beb3ba

(this sample)

MassLogger

Executable exe de7e69ec920dccdc40220e414a2d1b3bc05e53c5f5ea34e309bd3365aa5dae78

  
Dropping
MD5 93a02efc3319e40884d86f0603d6073d
  
Dropping
MassLogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 de7e69ec920dccdc40220e414a2d1b3bc05e53c5f5ea34e309bd3365aa5dae78

Comments