MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 331230ec27a985aeb8ab4526cd19407947b7afe51afb6abbbe1a74eb32eaa531. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

MassLogger

Vendor detections: 6

Intelligence 6 IOCs YARA 7 File information Comments

SHA256 hash:	331230ec27a985aeb8ab4526cd19407947b7afe51afb6abbbe1a74eb32eaa531
SHA3-384 hash:	d1582d582aa926ae9e8484c53e230ef821ded3f806e81fd3e5e001e19daea491006c0d0c82d076ef2551e8c4e53dd68c
SHA1 hash:	0828970bdccc18a098e8fccf94a328c81f2a76cf
MD5 hash:	7337649ac38df5220bd70ace94636f6c
humanhash:	hamper-nitrogen-mike-lemon
File name:	IMG_50117302.7z
Download:	download sample
Signature	MassLogger Create hunting rule
File size:	25'602 bytes
First seen:	2025-01-21 20:32:25 UTC
Last seen:	2025-01-21 22:56:34 UTC
File type:	7z
MIME type:	application/x-7z-compressed
ssdeep	768:NlCPyk4i7nLgRfdJq0m1b7XsJ06taxMcoml:NlCPyXi7qq77mV7Fml
TLSH	T199B2F1F9BEA48D20A43175C5B2F2623A82C037FC28975BDA08892D64509FF492E11B7D
TrID	57.1% (.7Z) 7-Zip compressed archive (v0.4) (8000/1) 42.8% (.7Z) 7-Zip compressed archive (gen) (6000/1)
Magika	sevenzip
Reporter	cocaman
Tags:	7z MassLogger

cocaman

Malicious email (T1566.001)
From: "Devan Mehta<magdi.messelhi@pec.it>" (likely spoofed)
Received: "from pec.it (ip85-215-135-25.pbiaas.com [85.215.135.25]) "
Date: "21 Jan 2025 22:55:48 +0000"
Subject: "Statement Of Account "
Attachment: "IMG_50117302.7z"

Intelligence

File Origin

# of uploads :

# of downloads :

108

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	IMG_50117302.exe
File size:	71'288 bytes
SHA256 hash:	500e0511666a6aced9ceb6e727bbe21cfaacefbf6529704848286238056f9875
MD5 hash:	1ce57c7a0654a0142c7ac4bb1ba4802e
MIME type:	application/x-dosexec
Signature	MassLogger

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Win32.DropperX-gen.19903.20322.UNOFFICIAL

Verdict:

Malicious

Score:

90.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=678fe27ae708b6e7a3aed175

Tags:

injection autorun obfusc micro

Result

Verdict:

Unknown

File Type:

PE File

Link:

https://app.docguard.net/331230ec27a985aeb8ab4526cd19407947b7afe51afb6abbbe1a74eb32eaa531/results/dashboard

Verdict:

Suspicious

Labled as:

Mal/Drod7zip

Link:

https://www.hybrid-analysis.com/sample/331230ec27a985aeb8ab4526cd19407947b7afe51afb6abbbe1a74eb32eaa531

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Score:

98%

Verdict:

Malware

File Type:

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)