MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 71ec70917f8d946d726140f22a9cfdd7946a0ee05a7171028ded05190214b5e2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 71ec70917f8d946d726140f22a9cfdd7946a0ee05a7171028ded05190214b5e2
SHA3-384 hash: cd89f1ba7ae08d6403f6c0839846784ed532e1339b56c26de5749a0bee77f892885cbcce4118f0a3e7d2c0eebe341667
SHA1 hash: 990f4ab4a6c87b643769e3cb4fa0c525668c0ecb
MD5 hash: 1d0d14ac7d1c1ebe116b5c178e83a4bf
humanhash: lemon-eleven-fix-eleven
File name:QUOTATION 4502058347.PDF.gz
Download: download sample
Signature MassLogger
Create hunting rule
File size:871'028 bytes
First seen:2020-07-29 11:59:08 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 24576:mt/0P5jzjfGOTt0wOgz4L7eLRRr18SHvh:mt+5jz79mw1U3ynr18SHvh
TLSH 1E0533CE04BBD584D989063C2C85AF7920C50A1E74AFBF97ED4AF89514DBBC01E6C85E
Reporter abuse_ch
Tags:gz Hostwinds MassLogger


Avatar
abuse_ch
Malspam distributing MassLogger:

HELO: hwsrv-755268.hostwindsdns.com
Sending IP: 104.168.220.131
From: Jarmila Vymazalová <info@gasteev.com>
Subject: RE: QUOTATION 4502058344
Attachment: QUOTATION 4502058347.PDF.gz (contains "QUOTATION 4502058347.PDF.exe")

MassLogger SMTP exfil server:
mail.devor.com.mx:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
64
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Siggen9.62857.19116.4837.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/71ec70917f8d946d726140f22a9cfdd7946a0ee05a7171028ded05190214b5e2/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-07-29 12:01:04 UTC
AV detection:
13 of 48 (27.08%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ohwhbel7rwkg24tbidzcvhh526kgudxaljyxcaun5ucrsaquwxra._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/71ec70917f8d946d726140f22a9cfdd7946a0ee05a7171028ded05190214b5e2

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

gz 71ec70917f8d946d726140f22a9cfdd7946a0ee05a7171028ded05190214b5e2

(this sample)

MassLogger

Executable exe 09d9572cad1a804f85d7bc282e21a9b5e351f44fc371fbcd84cf266a28cb4a5e

  
Dropping
MD5 7cd334a8a17b2b2b107bc9ee51ede07b
  
Dropping
MassLogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 09d9572cad1a804f85d7bc282e21a9b5e351f44fc371fbcd84cf266a28cb4a5e

Comments