MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5d661c0eb0c3412ba9f61af5317cf65f1b4ffd7f559ce8427b01c0e7872e42ff. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5d661c0eb0c3412ba9f61af5317cf65f1b4ffd7f559ce8427b01c0e7872e42ff
SHA3-384 hash: 0e20dbd1b09a59f2d4d93de0e67f2b5225e6a60bd5eb7b658369cbdb8cfb7cdc35b7646b8bd56c7b0c51f813eb3ba399
SHA1 hash: b75b1fce6f0a25896f2c1f14fdf69a00d298c288
MD5 hash: a073eb174b20fdfd8ef7b3a01b63e738
humanhash: december-glucose-quebec-floor
File name:DHL ARRIVAL SHIPMENT PRE-ALERT.xz
Download: download sample
Signature MassLogger
Create hunting rule
File size:917'571 bytes
First seen:2020-08-06 05:49:27 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:H7K/azDlxwreNQUyQuH+GMRBihbfNmc9NaopsDpTs:W/4DUQQUyQue3T8U6Z
TLSH CE1533E24C68F879FC4AABB1D600D94708C0F65433A25BC2FAC951DA2B6FDAD5D44CC6
Reporter abuse_ch
Tags:DHL MassLogger xz


Avatar
abuse_ch
Malspam distributing MassLogger:

HELO: srv1.toder.org
Sending IP: 109.232.220.218
From: DHL Express <NoReply.ODD@dhl.com>
Subject: DHL ARRIVAL SHIPMENT PRE-ALERT
Attachment: DHL ARRIVAL SHIPMENT PRE-ALERT.xz (contains "DHL ARRIVAL SHIPMENT PRE-ALERT.exe")

MassLogger SMTP exfil server:
mail.sbrenind.com:26

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5d661c0eb0c3412ba9f61af5317cf65f1b4ffd7f559ce8427b01c0e7872e42ff/
Threat name:
ByteCode-MSIL.Trojan.Hesv
Create hunting rule
Status:
Suspicious
First seen:
2020-08-06 05:51:05 UTC
AV detection:
5 of 48 (10.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=lvtbydvqynasxkpwdl2tc7hwl4nu77l7kwooqqt3ahaopbzoil7q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.45
Link:
https://yomi.yoroi.company/submissions/5d661c0eb0c3412ba9f61af5317cf65f1b4ffd7f559ce8427b01c0e7872e42ff

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

zip 5d661c0eb0c3412ba9f61af5317cf65f1b4ffd7f559ce8427b01c0e7872e42ff

(this sample)

MassLogger

Executable exe dc05645067f3f3ccf6a4e647dcf935c928fd981ef904672603a7ab409488166e

  
Dropping
MD5 d66436765b3cb3dc1a97beab0c6c7ae2
  
Dropping
MassLogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 dc05645067f3f3ccf6a4e647dcf935c928fd981ef904672603a7ab409488166e

Comments