MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4d250d01dedd78afb01b3402b31d8b2400fa57f4e52092efa8d9083d5b1d6090. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4d250d01dedd78afb01b3402b31d8b2400fa57f4e52092efa8d9083d5b1d6090
SHA3-384 hash: 29c35e679400c943c90dc4c11e46adc2d4d785b2892f7bb51675604b5d982d935f4369fe7509debb04528183275d474b
SHA1 hash: 626e6363114888bf0437133da11dedd35242716a
MD5 hash: 703063c7ebfb0c797f4efaa1fed761e7
humanhash: pizza-nineteen-triple-west
File name:InquirySW23020KT.com.gz
Download: download sample
Signature MassLogger
Create hunting rule
File size:981'797 bytes
First seen:2020-11-07 10:23:07 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 24576:2LEevhpJdU9H9gEyUSq91vA0UkE+xC3UOzUc0Ym+Esywmit:24evh09gEtSIygE/kCf0Yksywz
TLSH 3D25334E5B086E379BD49CFDB0603B186B567B34984F52FF0892D1229C6E78F3D8521A
Reporter abuse_ch
Tags:gz MassLogger


Avatar
abuse_ch
Malspam distributing MassLogger:

HELO: mail.bestwesternindonesia.com
Sending IP: 45.126.133.137
From: Zheng Mei Yan <meiyan@kimann.com>
Subject: Inquiry: SW/230/20/KT - Aluminium Alloy, A2024, Rod
Attachment: InquirySW23020KT.com.gz (contains "InquirySW23020KT.com.exe")

MassLogger SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
80
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.35111451.24358.25042.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4d250d01dedd78afb01b3402b31d8b2400fa57f4e52092efa8d9083d5b1d6090/
Threat name:
ByteCode-MSIL.Trojan.Masslogger
Create hunting rule
Status:
Malicious
First seen:
2020-11-06 17:36:32 UTC
AV detection:
23 of 48 (47.92%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=jusq2ao63v4k7ma3gqblghmleqapuv7u4uqjf35i3eed2wy5mcia._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

gz 4d250d01dedd78afb01b3402b31d8b2400fa57f4e52092efa8d9083d5b1d6090

(this sample)

MassLogger

Executable exe a4d56971577536b2742d89e0ead542a8cd8818a798371d1cd04ec22b3931ec56

  
Dropping
MD5 519080d90aa74ec4ce8fcf4dbf9040b4
  
Dropping
MassLogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a4d56971577536b2742d89e0ead542a8cd8818a798371d1cd04ec22b3931ec56

Comments