MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 44fee899ebeec1324a812d88a40d9f68824baec113e7520385d1f6a658e2ec84. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 44fee899ebeec1324a812d88a40d9f68824baec113e7520385d1f6a658e2ec84
SHA3-384 hash: 564ef47ddeaf486695e9f2fd1e269fa36f8cbfabbe77e86d9a25f2711bf46872a83fd029a9cff0dfaa908257689d5261
SHA1 hash: 72205560aaa7aa3787ca5e6a2b9614b735119147
MD5 hash: 10cac77805e52a908c1d92cd2a7f9f72
humanhash: eleven-december-alaska-summer
File name:TT COPY osdnsufsuifhsifudsujdfs,,,,.r25
Download: download sample
Signature MassLogger
Create hunting rule
File size:851'813 bytes
First seen:2020-05-26 10:30:44 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 24576:a3xmc5VBJSds50vA2CAFJq0oc3SgpOvw0WBAJqycsKBK3NRWE:+VSds5DQJd/p4XVEycsKgL
TLSH 040533F09A190C9EE570CF1904D65F422C9B017FC2667F9AF163A3B9C48921A9D327ED
Reporter abuse_ch
Tags:MassLogger r25


Avatar
abuse_ch
Malspam distributing MassLogger:

HELO: jmlapparel.com
Sending IP: 45.11.19.32
From: Niñ <jenny@jmlapparel.com>
Subject: TT Form (MAY 26, 2020) -BPI
Attachment: TT COPY osdnsufsuifhsifudsujdfs,,,,.r25 (contains "TT COPY osdnsufsuifhsifudsujdfs,,,,.exe")

MassLogger SMTP exfil server:
us2.smtp.mailhostbox.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-26 10:36:41 UTC
File Type:
Binary (Archive)
Extracted files:
14
AV detection:
17 of 48 (35.42%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

rar 44fee899ebeec1324a812d88a40d9f68824baec113e7520385d1f6a658e2ec84

(this sample)

MassLogger

Executable exe 45970f8f1497ab648eb24a71690d876dc6e18ed42e95da854252ec79b7939ab6

  
Dropping
MD5 6d37e918a7aeec2a9ebde6092dc75d72
  
Dropping
MassLogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 45970f8f1497ab648eb24a71690d876dc6e18ed42e95da854252ec79b7939ab6

Comments