MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 36dd8d404d1fb525edaf4fa9d50aaeba752635f811966ee592b3821ce2e49055. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 36dd8d404d1fb525edaf4fa9d50aaeba752635f811966ee592b3821ce2e49055
SHA3-384 hash: 027e56905de123d2f3a325027d213ee61aa5ce8ae813f23ae26b5fc3e0cefe624830a376e45d7bf0f9221ef2797b19f6
SHA1 hash: 452ae84131f998ec00f38554733468190b46d82a
MD5 hash: 2fc0041216bc1eb992cb1b7ea5bb78ef
humanhash: two-kansas-montana-london
File name:Price Request,pdf.r00
Download: download sample
Signature MassLogger
Create hunting rule
File size:853'494 bytes
First seen:2020-08-05 11:39:25 UTC
Last seen:Never
File type: r00
MIME type:application/x-rar
ssdeep 24576:y09XPt0OMnEPD1mdVWyBv1bTrUzThct95nVsF8qxv:LmEmLN1/wz2t95Vwj1
TLSH C4053356CF07588842D6162CA3A27E07D3A64813FCE2D9452DDEE0326A38F5DD4B9867
Reporter abuse_ch
Tags:MassLogger r00


Avatar
abuse_ch
Malspam distributing MassLogger:

HELO: tipografia-minulescu.ro
Sending IP: 31.14.12.18
From: Balikcioglu Sağlam <Balikcioglu.Saglam@alsimko-alarko.com.tr>
Subject: ALARKO // Price Request
Attachment: Price Request,pdf.r00 (contains "Price Request,pdf.exe")

MassLogger SMTP exfil server:
smtp.yandex.com.tr:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
56
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/36dd8d404d1fb525edaf4fa9d50aaeba752635f811966ee592b3821ce2e49055/
Threat name:
Win32.Trojan.Strictor
Create hunting rule
Status:
Malicious
First seen:
2020-08-05 11:40:10 UTC
AV detection:
11 of 47 (23.40%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=g3oy2qcnd62sl3npj6u5kcvoxj2smnpycglg5zmswobbzyxesbkq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/36dd8d404d1fb525edaf4fa9d50aaeba752635f811966ee592b3821ce2e49055

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

r00 36dd8d404d1fb525edaf4fa9d50aaeba752635f811966ee592b3821ce2e49055

(this sample)

MassLogger

Executable exe 921535a6ad60e212e6628f7ae40b356db57c7be4a70c4616d032226fca211523

  
Dropping
MD5 31bd8e740b21d6ace767d3a175ec11df
  
Dropping
MassLogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 921535a6ad60e212e6628f7ae40b356db57c7be4a70c4616d032226fca211523

Comments