MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 63fba1f5865021524422da5131c7d8509ecfeee6358a87e90c77b9ce202de498. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 63fba1f5865021524422da5131c7d8509ecfeee6358a87e90c77b9ce202de498
SHA3-384 hash: 5a268e9a4d1bd588bb792b5b5cb0ebeb2734c8973b8015d7738bdeb40c76a5318dc8d98950183fa66594fcf4d5780e0d
SHA1 hash: 00e35e3bf5f00ea9275cc3c377c0134e166518bf
MD5 hash: 9556e1b048e8e48db5c8cf801a12fc63
humanhash: jersey-moon-mexico-louisiana
File name:air way bill.bz
Download: download sample
Signature MassLogger
Create hunting rule
File size:792'540 bytes
First seen:2020-08-17 17:36:39 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:g4UY6ZjvG0TvIvyFuSOF1fA/Oi9jAwBxNS5v2scsPLF+H6bLC+aT25f7c/B+gL:AGyvxfNO3wjN8Fk6bLGT2V7cJ+gL
TLSH C4F42311228F871E72AC31A7B7F85204FAD980F565E0725FE1C82D71421EAB74D49EEB
Reporter abuse_ch
Tags:bz MassLogger


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: akriliktezgah.biz.tr
Sending IP: 162.221.204.210
From: Adbdelmageed <info@akriliktezgah.biz.tr>
Subject: Air Waybill HKHKG0000385370 34490017130765
Attachment: air way bill.bz (contains "air way bill.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/63fba1f5865021524422da5131c7d8509ecfeee6358a87e90c77b9ce202de498/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-08-17 17:38:06 UTC
AV detection:
19 of 48 (39.58%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=mp52d5mgkaqverbc3jitdr6ykcpm73xggwfip2imo6444ibn4sma._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.61
Link:
https://yomi.yoroi.company/submissions/63fba1f5865021524422da5131c7d8509ecfeee6358a87e90c77b9ce202de498

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

zip 63fba1f5865021524422da5131c7d8509ecfeee6358a87e90c77b9ce202de498

(this sample)

MassLogger

Executable exe b2169a0b14394b89cad7d3d4092b1a3e940c4504f9e7d982ebbcfd0b8c603530

  
Dropping
MD5 c9e0dc9c74c3782c0319ed1ce090287d
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b2169a0b14394b89cad7d3d4092b1a3e940c4504f9e7d982ebbcfd0b8c603530

Comments