MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2978b788d747c1dfe75e273d6fdff0dab0ac85e589a8f953786fa23d899276c5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2978b788d747c1dfe75e273d6fdff0dab0ac85e589a8f953786fa23d899276c5
SHA3-384 hash: 82f5c6af746efb32f61ee7163acd964864384bd2a7bdc9559bd2c4600fa21349e93dbd4b1c6d06de52caeab194a5bf81
SHA1 hash: ba244f3771b75379869805f80a0f2a2a641a9560
MD5 hash: 6dfe3c728249f76e9f7cde258a005ce1
humanhash: timing-echo-winter-cardinal
File name:Circulator 27643.iso
Download: download sample
Signature MassLogger
Create hunting rule
File size:1'038'336 bytes
First seen:2020-06-10 07:05:04 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 24576:av68+yXy99yJggfem35dQLLT3J4OgdNnK6S7l0:av/++yHyJg+QvT3J4OgdI
TLSH 1325F189365076DFC82BDD7689E82C249B6164B7532BD343B41B05AD9B0E7DACF006E3
Reporter abuse_ch
Tags:iso MassLogger


Avatar
abuse_ch
Malspam distributing MassLogger:

HELO: gki.com
Sending IP: 45.153.241.218
From: Purchase@gki.com
Subject: New Enquiry Circulator 26772
Attachment: Circulator 27643.iso (contains "Circulator 27643.exe")

MassLogger SMTP exfil server:
mail.itdone.cz:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
55
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Backdoor.NanoCore
Create hunting rule
Status:
Malicious
First seen:
2020-06-10 07:07:04 UTC
AV detection:
14 of 29 (48.28%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ff4lpcgxi7a57z26e46w7x7q3kykzbpfrgupsu3yn6rd3cmso3cq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

iso 2978b788d747c1dfe75e273d6fdff0dab0ac85e589a8f953786fa23d899276c5

(this sample)

MassLogger

Executable exe 7f2a8610931a1f5ff9793dcb854ca01aaa6410fb5b4dc287753c558f1b60eee1

  
Dropping
MD5 048b39faaf884a5eae0a72e2325a6fb0
  
Dropping
MassLogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7f2a8610931a1f5ff9793dcb854ca01aaa6410fb5b4dc287753c558f1b60eee1

Comments