MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 41224fc86e123f70e5f6960a3cc7bafe093ad8f7b6dd7cf4ce6ab43d4bb1fee3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 41224fc86e123f70e5f6960a3cc7bafe093ad8f7b6dd7cf4ce6ab43d4bb1fee3
SHA3-384 hash: 43b796072ca3aec14edcad9e76947e87cda5653627cc31eecd175eba2ed669189bda9d055cd6d01356ddc1c9a376d697
SHA1 hash: ed170fbeb89338c9600c19a4253fe081d442e201
MD5 hash: 14445833baf663c58183ee2d8f4bddd9
humanhash: sweet-december-zulu-skylark
File name:Payment Completed_pdf 1.gz
Download: download sample
Signature MassLogger
Create hunting rule
File size:647'659 bytes
First seen:2020-10-12 06:20:13 UTC
Last seen:2020-10-12 09:17:54 UTC
File type: gz
MIME type:application/x-rar
ssdeep 12288:5s6WmC72mCM9JZQJgK2HF4MtMHBjMZaFsWcOJqpZz5CgltLgDM:5svPJSJ+HFt0MysGMpldgw
TLSH B8D423505ABD4D9ECA6CA9B37F405BF3D3876AA836F7932413240572EABC73C0742661
Reporter abuse_ch
Tags:gz MassLogger


Avatar
abuse_ch
Malspam distributing MassLogger:

HELO: park-mx.above.com
Sending IP: 103.224.212.34
From: info@shelter-structure.com
Subject: RE: Payment advise
Attachment: Payment Completed_pdf 1.gz (contains "Payment Completed_pdf.exe")

Intelligence

File Origin
# of uploads :
5
# of downloads :
79
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/41224fc86e123f70e5f6960a3cc7bafe093ad8f7b6dd7cf4ce6ab43d4bb1fee3/
Threat name:
Win32.Trojan.LokibotCrypt
Create hunting rule
Status:
Malicious
First seen:
2020-10-12 02:23:26 UTC
AV detection:
18 of 29 (62.07%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=iere7sdoci7xbzpwsyfdzr527yetvwhxw3oxz5gonk2d2s5r73rq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/41224fc86e123f70e5f6960a3cc7bafe093ad8f7b6dd7cf4ce6ab43d4bb1fee3

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

gz 41224fc86e123f70e5f6960a3cc7bafe093ad8f7b6dd7cf4ce6ab43d4bb1fee3

(this sample)

MassLogger

Executable exe 1e3f14f932364db4904b69fce12e373e6354f4291dcda0d82a8477a21a9a803f

  
Dropping
MD5 1b8570091f5e224821e30845aa49379d
  
Dropping
MassLogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1e3f14f932364db4904b69fce12e373e6354f4291dcda0d82a8477a21a9a803f

Comments