MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2909694b162fb67f8b7d6f01bdb086d23216280a1f84565a13a4406ac46147c3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2909694b162fb67f8b7d6f01bdb086d23216280a1f84565a13a4406ac46147c3
SHA3-384 hash: 8c6110a8345ec48ad1d375a57f03a665b2ed3bb2892cb6a6b4cec814de357558025c66dbc4fb3d01201c222e06cd10aa
SHA1 hash: 4c7a556c5d7373bee762c51c716a548d6f6a4974
MD5 hash: 2fb78b099edc88207a4dbcfa8b6a44e0
humanhash: west-september-monkey-romeo
File name:doc000643665764.r00
Download: download sample
Signature MassLogger
Create hunting rule
File size:690'120 bytes
First seen:2020-07-30 10:04:18 UTC
Last seen:Never
File type: r00
MIME type:application/x-rar
ssdeep 12288:+6m8uc4Db+8G5nDM+QolDUseygbyCCIC2vwqV6Zm/t+Sg8MJkCSFvlr7:+dcuNoXLgbyCCU/V60gSg8MJXmR
TLSH 42E433777C55E65167F8CEAC355FF002706B7603E2AA49D52326190EF3F68829C28ACD
Reporter abuse_ch
Tags:MassLogger r00


Avatar
abuse_ch
Malspam distributing MassLogger:

HELO: i2k2.com
Sending IP: 212.114.52.213
From: Saurabh Gour <saurabh.gour@i2k2.com>
Reply-To: Saurabh Gour <saurabh.gour@i2k2.com>
Subject: Order No. DOC/00064/2020
Attachment: doc000643665764.r00 (contains "doc000643665764.exe")

MassLogger SMTP exfil server:
mail.ziv-investment.com:26

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2909694b162fb67f8b7d6f01bdb086d23216280a1f84565a13a4406ac46147c3/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-07-30 10:06:06 UTC
AV detection:
5 of 48 (10.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=feewssywf63h7c35n4a33meg2izbmkakd6cfmwqturagvrdbi7bq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2909694b162fb67f8b7d6f01bdb086d23216280a1f84565a13a4406ac46147c3

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

r00 2909694b162fb67f8b7d6f01bdb086d23216280a1f84565a13a4406ac46147c3

(this sample)

MassLogger

Executable exe 367c31b38577406fec107ed639cc6503710de53d8326b92504fd3919105ffce9

  
Dropping
MD5 e04ea3820e1699eb0cce1ddb55b91327
  
Dropping
MassLogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 367c31b38577406fec107ed639cc6503710de53d8326b92504fd3919105ffce9

Comments