MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1014e3ff8d65383001d162deae84ce61f607092791fcd4c45da29529505cc5e1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1014e3ff8d65383001d162deae84ce61f607092791fcd4c45da29529505cc5e1
SHA3-384 hash: 304c76738f7221ffccb59dcfcf7b0faaa524c44a21b8b6c502bfd48aa22bae2cf6e1c69c49135f246c5406f643704718
SHA1 hash: 22d4abd01c06320d3e63c14d1cd619bddf167b93
MD5 hash: 8ae52d45cef9a5fd2887b179514604de
humanhash: wisconsin-utah-ohio-johnny
File name:ORIGINAL SHIPPING DOCUMENTS.xls.z
Download: download sample
Signature MassLogger
Create hunting rule
File size:61'583 bytes
First seen:2020-10-16 10:47:12 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 1536:0/UZZM7ue+XUgN/HSLrIag9tW3+OrP5pAXB+QX3OGVM1f:0/UZW7uVXUKyIagr++YPTAwi+n1f
TLSH 265301EDB57807331C659E1376D4A0D73F8AD0B92D236A560D015B7BDA38C831A7B2CA
Reporter abuse_ch
Tags:DHL MassLogger z


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: serve0.manneytran.pw
Sending IP: 23.254.228.203
From: DHL | Express Shipping<hr@manneytran.pw>
Subject: (DHL)- AWB No : 907853880911 ARRIVAL NOTICE - ORIGINAL SHIPPING DOCUMENTS
Attachment: ORIGINAL SHIPPING DOCUMENTS.xls.z (contains "ORIGINAL SHIPPING DOCUMENTS.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
75
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1014e3ff8d65383001d162deae84ce61f607092791fcd4c45da29529505cc5e1/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-10-16 02:23:14 UTC
AV detection:
3 of 48 (6.25%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=cakoh74nmu4daaormlpk5bgomh3aocjhsh6njrc5ukkssuc4yxqq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/1014e3ff8d65383001d162deae84ce61f607092791fcd4c45da29529505cc5e1

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

zip 1014e3ff8d65383001d162deae84ce61f607092791fcd4c45da29529505cc5e1

(this sample)

MassLogger

Executable exe 08d49c14a81bc6b95397e6c0adc1efa3325fd00cd3ba6c7083353f7d93be1429

  
Dropping
MD5 2a4fc44cb733375e05ea0b79e4dc7621
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 08d49c14a81bc6b95397e6c0adc1efa3325fd00cd3ba6c7083353f7d93be1429

Comments