MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0680f0c5d7755f61f3defdb71816f574cc85a6dc0a6d12e5701283d4cafbb3c5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0680f0c5d7755f61f3defdb71816f574cc85a6dc0a6d12e5701283d4cafbb3c5
SHA3-384 hash: 880416f62c3c592208bf37417f8f3c6ac111b376b979367c4f897bf5e150e63a1628481574bae8a0273066af98e10aaa
SHA1 hash: 4d249df4222707385bb758bfb612123c5a7df6c9
MD5 hash: 1ab0fc860ec973573c7223d4084b77dd
humanhash: dakota-uranus-oklahoma-king
File name:PAYMENT10043210022211-pdf.7z
Download: download sample
Signature MassLogger
Create hunting rule
File size:585'731 bytes
First seen:2020-10-05 11:47:54 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:Yx8oE+BQr31Lu5MXMOdVFuWKYNX+0U563YLqkfZi1zUtX8i8Sq:Yx8yBmlLyMXMO7VX+0UcWqkR4ItXD8L
TLSH FBC423FDF65D61ABBD13F1FFAAA94BD34253940AD64234D9BB0303180EAA26D1580CDD
Reporter abuse_ch
Tags:7z MassLogger


Avatar
abuse_ch
Malspam distributing MassLogger:

HELO: lvps92-51-134-34.dedicated.hosteurope.de
Sending IP: 92.51.134.34
From: Frédéric AUBERT <contact@az-ouvertures.fr>
Reply-To: Frédéric AUBERT <baeutyslondon@yahoo.com>
Subject: PAYMENT UPDATE
Attachment: PAYMENT10043210022211-pdf.7z (contains "PAYMENT10043210022211-pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
92
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0680f0c5d7755f61f3defdb71816f574cc85a6dc0a6d12e5701283d4cafbb3c5/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-10-05 08:01:29 UTC
AV detection:
12 of 48 (25.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=a2apbroxovpwd4667w3rqfxvotgiljw4bjwrfzlqckb5jsx3wpcq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0680f0c5d7755f61f3defdb71816f574cc85a6dc0a6d12e5701283d4cafbb3c5

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

zip 0680f0c5d7755f61f3defdb71816f574cc85a6dc0a6d12e5701283d4cafbb3c5

(this sample)

MassLogger

Executable exe f8f5e97b40ead4c316e0dc6adc5490aafdf806ec5c203931e9d699be3b95a88a

  
Dropping
MD5 f6d9a396a302de65e44d4887636e32bb
  
Dropping
MassLogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f8f5e97b40ead4c316e0dc6adc5490aafdf806ec5c203931e9d699be3b95a88a

Comments