MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2cac115d43ee23581e2b341477ea8cd2c7ab7ffddbbf1e93831dd147bcd3e201. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2cac115d43ee23581e2b341477ea8cd2c7ab7ffddbbf1e93831dd147bcd3e201
SHA3-384 hash: 40ab2e290267aca802227472017fe9f9a70cbdde59e33cebeee1e007138b74bfe99d10036d789e8ff95375c0d67068a7
SHA1 hash: 8eec3769403002300a473797e3cc821aff8dbd8e
MD5 hash: c11dd54efd734b726a7e8335a94b0513
humanhash: bravo-summer-april-mars
File name:August Order2020.PDF.zip
Download: download sample
Signature MassLogger
Create hunting rule
File size:805'525 bytes
First seen:2020-08-19 11:51:38 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:GBdTKWbFIZCTanXWCh2cmCHaJnhT6owC5c048o/SBkjtdgRLFEQJC6HhNIpwxVvC:uSjXDHaJhTxw0LZySBzfa6XxVq
TLSH 0C053329256503E1D753ECA370C974E7C14196F0798E7093FA38DA9B4A8BDCAC709D2E
Reporter abuse_ch
Tags:MassLogger SendGrid zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: wrqvqntk.outbound-mail.sendgrid.net
Sending IP: 149.72.66.113
From: Jessica <order@em9914.jcwholesale.co.uk>
Reply-To: <info@industralmail.com>
Subject: August Order
Attachment: August Order2020.PDF.zip (contains "August Order2020.PDF.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.25510.ZipHeur.Ext.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2cac115d43ee23581e2b341477ea8cd2c7ab7ffddbbf1e93831dd147bcd3e201/
Threat name:
ByteCode-MSIL.Trojan.CryptInject
Create hunting rule
Status:
Malicious
First seen:
2020-08-18 13:30:50 UTC
AV detection:
28 of 48 (58.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=fswbcxkd5yrvqhrlgqkhp2um2ld2w7753o7r5e4ddxiuppgt4iaq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2cac115d43ee23581e2b341477ea8cd2c7ab7ffddbbf1e93831dd147bcd3e201

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

zip 2cac115d43ee23581e2b341477ea8cd2c7ab7ffddbbf1e93831dd147bcd3e201

(this sample)

MassLogger

Executable exe 81294a847822a4b2b75133370a6b627d8fd2db2470767608522c4229ffa88133

  
Dropping
MD5 88a058ae596480716d3e24bc0a6e8b30
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 81294a847822a4b2b75133370a6b627d8fd2db2470767608522c4229ffa88133

Comments