MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 80f21cb5b0ce5875df57ef265712066b6ea4496a4a62819e945dac22a15d43d6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 80f21cb5b0ce5875df57ef265712066b6ea4496a4a62819e945dac22a15d43d6
SHA3-384 hash: c41ee3d80fe066a5ebe257c67cd71bc467d644657e1ec244a5c5d9a27cd9e0fec0f623869b9dac527a6edfb20d4f9b3a
SHA1 hash: 641902bae1c4ea6fdbafb7718f7b546629c33734
MD5 hash: 53ea2e10b8e34323219ca62c91f238a1
humanhash: mexico-jersey-thirteen-cup
File name:NEW736_SC736_PDF.rar
Download: download sample
Signature MassLogger
Create hunting rule
File size:993'563 bytes
First seen:2020-07-22 08:42:33 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 24576:1vTMks2ySjfEn0ShuJEuFAAXVhJM5+C9EgnC:hlyTuJE7mhWsyEgC
TLSH 2D25336EC379BCE645E12F16506BAF2E8574BC24ED0B13C1E5981F8EC5E4927A708783
Reporter abuse_ch
Tags:MassLogger rar


Avatar
abuse_ch
Malspam distributing MassLogger:

HELO: s51-89-27.eu-de.sugarhosts.net
Sending IP: 51.89.27.131
From: sales@comex.com.eg
Subject: Re: New Order
Attachment: NEW736_SC736_PDF.rar (contains "NEW736_SC736_PDF.exe")

MassLogger SMTP exfil server:
smtp.gmail.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27271.Rar5Heur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/80f21cb5b0ce5875df57ef265712066b6ea4496a4a62819e945dac22a15d43d6/
Threat name:
ByteCode-MSIL.Trojan.MassLogger
Create hunting rule
Status:
Malicious
First seen:
2020-07-22 08:44:06 UTC
AV detection:
16 of 28 (57.14%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=qdzbznnqzzmhlx2x54tfoeqgnnxkislkjjridhuulwwcfik5ipla._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/80f21cb5b0ce5875df57ef265712066b6ea4496a4a62819e945dac22a15d43d6

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

rar 80f21cb5b0ce5875df57ef265712066b6ea4496a4a62819e945dac22a15d43d6

(this sample)

MassLogger

Executable exe 4193084a6eba68bbb6aef41ffc1f21685208c6b942de9e5853b70b04834c296e

  
Dropping
MD5 fdc2c2647e2bc4559501196ef4cd68e8
  
Dropping
MassLogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4193084a6eba68bbb6aef41ffc1f21685208c6b942de9e5853b70b04834c296e

Comments