MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 43985ffb8fce30953ef1abe007bf264f4cb908588fd21da7e5d4db762dbf6ec0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Intelligence File information Yara Comments

SHA256 hash: 43985ffb8fce30953ef1abe007bf264f4cb908588fd21da7e5d4db762dbf6ec0
SHA3-384 hash: 1480017b4a0e199d203e3d729fcf1ff030bd673e101339ec3daaaee4e97e65624f094af2dc7264321d39268fb8f2d3cf
SHA1 hash: 7077be18bb92c4b87e42737cf0db8e4ef30e40ab
MD5 hash: bf34afe031db41b21f936c37a8529028
humanhash: nine-golf-fanta-nuts
File name:DHL DETAILS PDF.z
Download: download sample
Signature MassLogger
File size:761'885 bytes
First seen:2020-06-29 09:04:30 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:575d35vLi0Xj0v733Un8LxXx77oJRB0KJ1WvJYqdvadSN9xNB4rtzXtsEa8IhKcU:5Pt+HvLUiD7oOKuJxycNYB9HsgnRJ1F
TLSH F3F433440DCE99005C5A59F3A878E07246D2D6A8D5424F2F48CE9B3D4B3BE7BD7CBA81
Reporter @abuse_ch
Tags:DHL MassLogger z


Twitter
@abuse_ch
Malspam distributing MassLogger:

HELO: ceruler.com
Sending IP: 23.108.57.211
From: DHL Express International <info@ceruler.com>
Reply-To: infodhl_internation@fastservice.com
Subject: DHL SHIPPMENT ARRIVAL NOTICE
Attachment: DHL DETAILS PDF.z (contains "DHL.PDF.exe")

MassLogger SMTP exfil server:
mail.mytravelexplorer.com:587

Intelligence


File Origin
# of uploads :
1
# of downloads :
33
Origin country :
FR FR
Mail intelligence
Geo location:
Global
Volume:
Low
Vendor Threat Intelligence
Threat name:
ByteCode-MSIL.Trojan.Genkryptik
Status:
Malicious
First seen:
2020-06-29 09:06:05 UTC
AV detection:
18 of 48 (37.50%)
Threat level
  2/5

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

zip 43985ffb8fce30953ef1abe007bf264f4cb908588fd21da7e5d4db762dbf6ec0

(this sample)

  
Dropping
MassLogger
  
Delivery method
Distributed via e-mail attachment

Comments