MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 20274848d7427be581ed8a795ff0d0c7fbf47bf02629690e122c713fe7471538. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 20274848d7427be581ed8a795ff0d0c7fbf47bf02629690e122c713fe7471538
SHA3-384 hash: f13dfc7e259764f4e142d66765b8420992a80a474411bfcb6f34ac86a238e302eab944625a639255c8c2e7e508e6df2a
SHA1 hash: 0026ad052370e855d37c5f2969ce2bdce620d148
MD5 hash: 04253edfb3e733da6b559fa1118ee57a
humanhash: aspen-coffee-vermont-yellow
File name:Shipment invoice packing-list.rar
Download: download sample
Signature MassLogger
Create hunting rule
File size:936'073 bytes
First seen:2020-10-23 06:38:18 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 24576:qCvljyCMKJ2c2xPgX4xr8ASvEdVYAxUwJt4YIzV69U/0Aw:vljrHGgoxgARdVr3/4Z//0B
TLSH 161533BBD650C910188C7D79BEF96BC60E9F57C3E118C3B183F22506BA9BD582193B25
Reporter abuse_ch
Tags:DHL MassLogger rar


Avatar
abuse_ch
Malspam distributing MassLogger:

HELO: srv1.demspor.com
Sending IP: 31.169.94.221
From: DHL International <info@umutkama.com>
Reply-To: DHL International <info@umutkama.com>
Subject: Re: Your Shipment invoice & packing-list
Attachment: Shipment invoice packing-list.rar (contains "oY8tE0vuPnTUwGF.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
68
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/20274848d7427be581ed8a795ff0d0c7fbf47bf02629690e122c713fe7471538/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-10-22 21:04:53 UTC
AV detection:
7 of 48 (14.58%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=eatuqsgxij56lapnrj4v74gqy757i67qeyuwsdqsfryt7z2hcu4a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

rar 20274848d7427be581ed8a795ff0d0c7fbf47bf02629690e122c713fe7471538

(this sample)

MassLogger

Executable exe 1412ead7a7d061d4dbffd755b8ed9881da5ba163d90139df128fc4e4d26e93b6

  
Dropping
MD5 b5a7362e38727f542f72302df4a0a56d
  
Dropping
MassLogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1412ead7a7d061d4dbffd755b8ed9881da5ba163d90139df128fc4e4d26e93b6

Comments