MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0d9930e5d94379f7ec2e920e76dbec412d8697cf55e34210aaa27351a5b57658. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0d9930e5d94379f7ec2e920e76dbec412d8697cf55e34210aaa27351a5b57658
SHA3-384 hash: f8c31ccb895704506fda0898d577b0f085057bdb50b5d60ec1eddd8b7b1d34cd25a6366438413c3b73136fc0c3aa932d
SHA1 hash: c70fde7e44ba7345227a772efe9968df6f90ee6d
MD5 hash: b358254a06c69d3c2c8e9931ee585f54
humanhash: golf-hot-blossom-berlin
File name:DBEN8420.rar
Download: download sample
Signature MassLogger
Create hunting rule
File size:864'929 bytes
First seen:2020-08-31 10:46:49 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 24576:qNUfbe68MVvqgDdEdzn1Ge87/3ULXEG8I83QY:mUSjgrDdE91z23ULhi
TLSH E60533F1DED63E8033EA7C75C3B6667D04F21D29D0D4E43A9E1490CDCB99836A699078
Reporter abuse_ch
Tags:MassLogger rar Yahoo


Avatar
abuse_ch
Malspam distributing MassLogger:

HELO: sonic305-19.consmr.mail.ir2.yahoo.com
Sending IP: 77.238.177.81
From: Mr Rivas Walter <mrrivaswalter@yahoo.co.uk>
Subject: : Fwd : Advance payment copy
Attachment: DBEN8420.rar (contains "l4X6wuDvpZZ3Udd.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0d9930e5d94379f7ec2e920e76dbec412d8697cf55e34210aaa27351a5b57658/
Threat name:
ByteCode-MSIL.Backdoor.Androm
Create hunting rule
Status:
Malicious
First seen:
2020-08-31 05:38:07 UTC
AV detection:
13 of 29 (44.83%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=bwmtbzozin47p3bosihhnw7miewynf6pkxrueefkujzvdjnvozma._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/0d9930e5d94379f7ec2e920e76dbec412d8697cf55e34210aaa27351a5b57658

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

rar 0d9930e5d94379f7ec2e920e76dbec412d8697cf55e34210aaa27351a5b57658

(this sample)

MassLogger

Executable exe f9780f06f0da7544e13584ce58e03ccb796326b01dc2d05f5f5917aa461710be

  
Dropping
MD5 1c20f6b438014300bf87dd1fab2bfe4b
  
Dropping
MassLogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f9780f06f0da7544e13584ce58e03ccb796326b01dc2d05f5f5917aa461710be

Comments