MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ff9f73c57d1cf21e73311761d6ab69e59782bc63f3254a5f04e541b492beb3ba. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Intelligence File information Yara Comments

SHA256 hash: ff9f73c57d1cf21e73311761d6ab69e59782bc63f3254a5f04e541b492beb3ba
SHA3-384 hash: d3f897d4af4bd805130326a4176246ea3faafda068261eaa0be1d0af1403e6193331900aab93ea3231278153a9085c75
SHA1 hash: 5f8599b4ef9eb931ac595373e7961e18c097fca8
MD5 hash: 430b1a59d711169c7b0ebdbe17b0124f
humanhash: hawaii-sierra-arkansas-delaware
File name:Q2020-07-466am.iso
Download: download sample
Signature MassLogger
File size:1'503'232 bytes
First seen:2020-07-31 10:16:16 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:yHX8kTaa4C/vW/R7h2Iq2oJUadK0RXgJ3ukGHN5uKyOtTiZfhz:yHLTEJ9rqUozRlkGLuKyYTQ
TLSH EC65293E38834514C969463580289AC1BAE1A74B3B62CB5DE1EF134F5F03B6B7B560DE
Reporter @abuse_ch
Tags:iso MassLogger


Twitter
@abuse_ch
Malspam distributing MassLogger:

HELO: mexportools.mx
Sending IP: 37.49.230.253
From: Eduardo Malato <eduardo.malato@mexportools.mx>
Subject: RE: Q2020-07-466am
Attachment: Q2020-07-466am.iso (contains "Q2020-07-466am.exe")

MassLogger SMTP exfil server:
mail.privateemail.com:587

Intelligence


File Origin
# of uploads :
1
# of downloads :
31
Origin country :
US US
Mail intelligence
Geo location:
Global
Volume:
Medium
Vendor Threat Intelligence
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Status:
Malicious
First seen:
2020-07-31 10:18:07 UTC
AV detection:
14 of 48 (29.17%)
Threat level
  5/5
Threat name:
Legit
Score:
0.00

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

iso ff9f73c57d1cf21e73311761d6ab69e59782bc63f3254a5f04e541b492beb3ba

(this sample)

  
Dropping
MassLogger
  
Delivery method
Distributed via e-mail attachment

Comments