MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4e00687c115122e6ea9dfd44a6a8ada1262dc16a1bdf16344b671b6d6f5381d3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4e00687c115122e6ea9dfd44a6a8ada1262dc16a1bdf16344b671b6d6f5381d3
SHA3-384 hash: 80591430af7b00e30f47816b2d9bc4544e561b3cd25c14b024d90aab8a8d3c808572b650349da30a644cc3a8d48cac44
SHA1 hash: 8a23643689f96e21331d1f417d1f607542a4ae06
MD5 hash: e553895c64f4d8ddf623219466707edf
humanhash: thirteen-social-fish-don
File name:e-dekont PDF.rar
Download: download sample
Signature MassLogger
Create hunting rule
File size:938'678 bytes
First seen:2020-10-23 08:57:32 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 24576:7Px6FoVDENfVH/fboOIC2KKP15PduCmykS4atK5obfD:YFVxzrx2KKP15PduCmFaZH
TLSH F315333BE0355702A65A72CC70302552CB83262829DBD763B6641FA78967C6FC6B4F27
Reporter abuse_ch
Tags:geo MassLogger rar TUR ZiraatBank


Avatar
abuse_ch
Malspam distributing MassLogger:

HELO: srv1.demspor.com
Sending IP: 31.169.94.221
From: ZIRAAT BANKASIi <ziraatbank@ileti.ziraatbank.com.tr>
Reply-To: noreply@ileti.ziraatbank.com.tr
Subject: DEKONT
Attachment: e-dekont PDF.rar (contains "lRUEtslD4ZK2zFL.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
96
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4e00687c115122e6ea9dfd44a6a8ada1262dc16a1bdf16344b671b6d6f5381d3/
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=jyagq7arkeron2u57vcknkfnuetc3qlkdpprmnclm4nw232tqhjq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

rar 4e00687c115122e6ea9dfd44a6a8ada1262dc16a1bdf16344b671b6d6f5381d3

(this sample)

MassLogger

Executable exe d94d1cbec995584fc86297b547174128fa71a0e8b3b8de39183e8774cad65826

  
Dropping
MD5 d1d203bcc468da704744d7c99bb8396a
  
Dropping
MassLogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d94d1cbec995584fc86297b547174128fa71a0e8b3b8de39183e8774cad65826

Comments