MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 12dff816b362ad78da4e91dae02358a70b9c4e37c32630f9f4935bf3811d04b1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 12dff816b362ad78da4e91dae02358a70b9c4e37c32630f9f4935bf3811d04b1
SHA3-384 hash: 24c3f7d93e393c8e6376b56e082ecf43a3d05bcd52bea032530b394f12e649e38a1f9d1cf7a55cc255f81e6eb3e33049
SHA1 hash: 9f4215c371f6e9c8bba0542f4c7b26544cbf750a
MD5 hash: c73797653e845438b35b4e953c9ac7c7
humanhash: coffee-twenty-seven-undress
File name:DHL_January 2021 at 70M_9B7290_PDF.img
Download: download sample
Signature MassLogger
Create hunting rule
File size:1'441'792 bytes
First seen:2021-01-18 09:07:16 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 24576:VVXLv6Y8/ACLG/Pl5a4dUSX7rLPgt4dy8pbbo39DM5h+:VZ76L/nLG3aPSXDPgt8pYWH+
TLSH 9865012172E01395E5F527B11AA3D86807777D1F8637C30AADEE73DE0A723858216B27
Reporter abuse_ch
Tags:DHL img MassLogger


Avatar
abuse_ch
Malspam distributing MassLogger:

HELO: 023.gestiondealojamiento.com
Sending IP: 193.42.143.82
From: DHL Customer Support <noreply@dhl.com>
Subject: RE: DHL Express Shipment // AWB_5011014
Attachment: DHL_January 2021 at 70M_9B7290_PDF.img (contains "DHL_January 2021 at 70M_9B7290_PDF.exe")

MassLogger SMTP exfil server:
mail.beljemi.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
149
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.507.22426.23582.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/12dff816b362ad78da4e91dae02358a70b9c4e37c32630f9f4935bf3811d04b1/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-01-17 22:28:31 UTC
AV detection:
7 of 46 (15.22%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=clp7qfvtmkwxrwsoshnoai2yu4fzytrxymtdb6pusnn7hai5asyq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Eldorado
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/12dff816b362ad78da4e91dae02358a70b9c4e37c32630f9f4935bf3811d04b1

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

img 12dff816b362ad78da4e91dae02358a70b9c4e37c32630f9f4935bf3811d04b1

(this sample)

MassLogger

Executable exe f5a271d64ab777a898207f0614834620fbb7c4ebb741f7572afb2d13756f2b89

  
Dropping
MD5 24977e68cf3835f792b974848cdfc0eb
  
Dropping
MassLogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f5a271d64ab777a898207f0614834620fbb7c4ebb741f7572afb2d13756f2b89

Comments