MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 527a9c6392096c6d0480bafd8d0da57a44ed91f2af23d9e10bd3377b4afb4d35. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 527a9c6392096c6d0480bafd8d0da57a44ed91f2af23d9e10bd3377b4afb4d35
SHA3-384 hash: f20f3c93413c73b70d79007d0f617df347bd455ee5403c1404a64507908bb6782f747e1e9f54ebad4c2b3d6542935020
SHA1 hash: c0d20bb39f69074ba89b1c6a2678c571e545e0fd
MD5 hash: 8f47c52b0a60da89fbec71e123625be1
humanhash: fourteen-nineteen-low-high
File name:Zahlung für INV 00290418.zip
Download: download sample
Signature MassLogger
Create hunting rule
File size:586'398 bytes
First seen:2020-08-14 10:42:55 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:xP4fj1lKt/W25jm2qruMlm+lEKIkT/PQUFH/EZXccX5+gq9g6:iPiW2Pqr9myEKIkDNffcX549g6
TLSH 70C433D5AA84E2BAF14237C327D257D47F42A6C386E343754E6BE507420D88B756F8C2
Reporter abuse_ch
Tags:DEU geo MassLogger zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: vl52566.dns-privadas.es
Sending IP: 62.138.137.228
From: MANUEL FIGUEROA <figueroasrl2020@gmail.com>
Subject: Zahlung für INV 002904/18
Attachment: Zahlung für INV 00290418.zip (contains "Zahlung für INV 00290418.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.FileRepMalware.18703.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/527a9c6392096c6d0480bafd8d0da57a44ed91f2af23d9e10bd3377b4afb4d35/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-08-14 10:44:06 UTC
AV detection:
6 of 48 (12.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=kj5jyy4sbfwg2beaxl6y2dnfpjco3epsv4r5tyil2m3xwsx3ju2q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/527a9c6392096c6d0480bafd8d0da57a44ed91f2af23d9e10bd3377b4afb4d35

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

zip 527a9c6392096c6d0480bafd8d0da57a44ed91f2af23d9e10bd3377b4afb4d35

(this sample)

MassLogger

Executable exe cc4c45cb30d6771f9947cb7fdd713fd9c6f0e726a3ed71c73a3cfb4c4262c07a

  
Dropping
MD5 f6c4e36d6d660915f40b40b97f143100
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 cc4c45cb30d6771f9947cb7fdd713fd9c6f0e726a3ed71c73a3cfb4c4262c07a

Comments