MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 034e6fae9136bedf31c6fa7cbc23cbf87ae34a4fb21a200314a4bc0f8b706a8b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 034e6fae9136bedf31c6fa7cbc23cbf87ae34a4fb21a200314a4bc0f8b706a8b
SHA3-384 hash: 4a2579dfe569482b95925b9cd8a61f4d4633e03dfed021aae7b8326fd4260fab175f94d9c8307027c414eb1fdc6f8c91
SHA1 hash: da5767e762107304befc0a7e0f72674a5fa3c156
MD5 hash: dd831fba44e0a0ac10a970bd2471e922
humanhash: florida-texas-blossom-bluebird
File name:New PO0042.gz
Download: download sample
Signature MassLogger
Create hunting rule
File size:972'785 bytes
First seen:2020-07-29 14:40:51 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 12288:8qAlfmjt7KrsqTLjXV17gb82jNtlf0YsyTpyUS7n9isK6ux369/jPCBgHUB61Zkd:Sl46Lihlf0a9S7n946udkbzU642kh
TLSH 9D2533F8B04B317E63BDA91726447B04A996D22137036EED50DC9AAB4671CCEBC4ECD1
Reporter abuse_ch
Tags:gz MassLogger


Avatar
abuse_ch
Malspam distributing MassLogger:

HELO: als.sparkmail.jp
Sending IP: 202.233.10.33
From: asep.yusuf@ngehe.com
Subject: New POs - Ready for payment
Attachment: New PO0042.gz (contains "New PO0042.exe")

MassLogger SMTP exfil server:
smtp.gmail.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
75
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Mal.DrodGzip-A.26380.25151.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/034e6fae9136bedf31c6fa7cbc23cbf87ae34a4fb21a200314a4bc0f8b706a8b/
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=anhg7lurg27n6mog7j6lyi6l7b5ogsspwincaayuus6a7c3qnkfq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Farheyt
Score:
0.80
Link:
https://yomi.yoroi.company/submissions/034e6fae9136bedf31c6fa7cbc23cbf87ae34a4fb21a200314a4bc0f8b706a8b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

gz 034e6fae9136bedf31c6fa7cbc23cbf87ae34a4fb21a200314a4bc0f8b706a8b

(this sample)

MassLogger

Executable exe 5d5405cf3198047a427b4da472f40ab86a0cd75b9c07f3b8be17e6bca87c149f

  
Dropping
MD5 febe72287982a2f1bec5923deb36cbad
  
Dropping
MassLogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 5d5405cf3198047a427b4da472f40ab86a0cd75b9c07f3b8be17e6bca87c149f

Comments