MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2c2ff3c1c378b7dacd2bd7013388738bf26f4dcd5e4d2911217e71d7f3a06375. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2c2ff3c1c378b7dacd2bd7013388738bf26f4dcd5e4d2911217e71d7f3a06375
SHA3-384 hash: 78325bea4ca3069b814dc875e46b8d62b5a29b70d6e6001d1ba0eb55b51c134949489ddfcbd2344562c713fbbaa40638
SHA1 hash: ef5f5c2a39a460ebc8946ca393b2258236a15db8
MD5 hash: 913089cec335839522461469c98b6b3c
humanhash: uniform-kitten-early-romeo
File name:repeat order.pdf.z
Download: download sample
Signature MassLogger
Create hunting rule
File size:116'829 bytes
First seen:2020-09-10 09:09:50 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 1536:MUfjZkc0VxMyji0yhDC2AVdmdjRsHSPwy+mJpnRPlsQ8dbimv1jCY7X2Lx9tOU2k:M2mVxMei0y9+++8RPyd2me2hI4O
TLSH 38B312D8B9AADBCF9FE8D178D6C99CD2534D20AFA72CB519631102C202C794805CBE9D
Reporter abuse_ch
Tags:MassLogger z


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: mondigroup.com
Sending IP: 156.96.118.47
From: Anatoliy Bogutev <anatoliy.bogutev@mondigroup.com>
Subject: Repeat order.
Attachment: repeat order.pdf.z (contains "repeat order.pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
91
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.25518.ZipHeur.Ext.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2c2ff3c1c378b7dacd2bd7013388738bf26f4dcd5e4d2911217e71d7f3a06375/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-09-10 06:37:23 UTC
AV detection:
16 of 48 (33.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=fqx7hqodpc35vtjl24athcdtrpzg6tonlzgssejbpzy5p45amn2q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2c2ff3c1c378b7dacd2bd7013388738bf26f4dcd5e4d2911217e71d7f3a06375

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

zip 2c2ff3c1c378b7dacd2bd7013388738bf26f4dcd5e4d2911217e71d7f3a06375

(this sample)

MassLogger

Executable exe 96a8399aef7760c49b1b2fd59de6f8747f5de3bf85249c5d7e09e7499a5c097f

  
Dropping
MD5 feba2ac534f1b5b5ce389fa9674efd4e
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 96a8399aef7760c49b1b2fd59de6f8747f5de3bf85249c5d7e09e7499a5c097f

Comments