MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7fe896e93b345055c03b0cf572a3b805068933182d1b853063ca697ea3b794c1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7fe896e93b345055c03b0cf572a3b805068933182d1b853063ca697ea3b794c1
SHA3-384 hash: b55764edbb4c9055cfb0214879ddecb2b3e86c04d026ad551a06fc4ac580f6630d7f98f0137ee9e3e8dd3ea7913e0faf
SHA1 hash: c3dcc9f37f94939a9e7588ed609bca825824fac2
MD5 hash: f642795ae4cc73d554849e06a5565c50
humanhash: twelve-jupiter-coffee-zulu
File name:PAYMENT SWIFT COPY.PDF.Z
Download: download sample
Signature MassLogger
Create hunting rule
File size:576'822 bytes
First seen:2020-10-12 19:22:22 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 12288:E5SVd0oOBB8nZIZwC1VGRBAyaKH6PQIGakPaaCD3fWL8digwJBT:zDJZcWyyaE5IgpkU3x
TLSH 81C423143F15A2EF8BCF23AC6499DB25FDF9974AC57223386F9E8BE64304DA1C619014
Reporter abuse_ch
Tags:MassLogger z


Avatar
abuse_ch
Malspam distributing MassLogger:

HELO: webmail.cyber.net.pk
Sending IP: 203.101.175.37
From: ACCOUNT DEPT <dml@cyber.net.pk>
Subject: PAYMENT SWIFT COPY
Attachment: PAYMENT SWIFT COPY.PDF.Z (contains "PAYMENT SWIFT COPY.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
105
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7fe896e93b345055c03b0cf572a3b805068933182d1b853063ca697ea3b794c1/
Threat name:
ByteCode-MSIL.Trojan.Strictor
Create hunting rule
Status:
Malicious
First seen:
2020-10-12 16:16:06 UTC
AV detection:
15 of 48 (31.25%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=p7ujn2j3griflqb3bt2xfi5yaudismyyfunykmddzjux5i5xstaq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/7fe896e93b345055c03b0cf572a3b805068933182d1b853063ca697ea3b794c1

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

z 7fe896e93b345055c03b0cf572a3b805068933182d1b853063ca697ea3b794c1

(this sample)

MassLogger

Executable exe c449101275bb3598eefd33c8fffa61da3bff7f3b3da684b0a1b8c0ecf4535e7c

  
Dropping
MD5 700524966f7e00fdf2590f7e0beadbbc
  
Dropping
MassLogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c449101275bb3598eefd33c8fffa61da3bff7f3b3da684b0a1b8c0ecf4535e7c

Comments