MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 436721c75699b2ced805e19545c98e72f8d9e3d2e93efdbba086911e98757036. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 436721c75699b2ced805e19545c98e72f8d9e3d2e93efdbba086911e98757036
SHA3-384 hash: 72f8106bf3850e8fdf9932002f7240489ae0d9bb66606bbda32e71478a10045d86ee7cf8858c0f07c494fe92ef9a11a0
SHA1 hash: c478c7c2604f066f71a4dd8a2938923f0cc7904f
MD5 hash: bdc993a2fe4a8a10aa6814062e4408ff
humanhash: kilo-tango-maine-alanine
File name:DHL_May 2020 at 90.6C7M490_PDF.img
Download: download sample
Signature MassLogger
Create hunting rule
File size:1'966'080 bytes
First seen:2020-06-12 06:55:22 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:oaU46VEt6QMQ4jawiY0ujYfUaVqJ54O9Pb2j5cPA7iYxdS8JW0K6K:e46NPQ4jsdfUs4D9PbK5c3YxQo
TLSH 61953A3A31C14808C5280632807A9AC1BAF66B843A63DB5EF1AF535B9F43B6F77511DD
Reporter abuse_ch
Tags:DHL img MassLogger


Avatar
abuse_ch
Malspam distributing MassLogger:

HELO: host6.fastpath.gr
Sending IP: 176.119.210.163
From: DHL Customer Support <noreply@dhl.com>
Subject: Re: DHL Notification / DHL_AWB_0011179303/ ETD
Attachment: DHL_May 2020 at 90.6C7M490_PDF.img (contains "DHL_May 2020 at 90.6C7M490_PDF.exe")

MassLogger SMTP exfil server:
mail.kogep-k.hu:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
64
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Variant.Razy.685233.23270.20198.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-12 06:57:05 UTC
AV detection:
15 of 31 (48.39%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=intsdr2wtgzm5waf4gkulsmool4nty6s5e7p3o5aq2ir5gdvoa3a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

img 436721c75699b2ced805e19545c98e72f8d9e3d2e93efdbba086911e98757036

(this sample)

MassLogger

Executable exe a3597ac0873ae3a71729eed1521710b6899ed9d886601b4b9e2ed207db1f087c

  
Dropping
MD5 8f8abb6f33adbb7043c405bba2c19968
  
Dropping
MassLogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a3597ac0873ae3a71729eed1521710b6899ed9d886601b4b9e2ed207db1f087c

Comments