MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c1089d2ab0dec80be8b857ddf5d1f8df7b41a7aa540cdea71de7dc52d90d8a8a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c1089d2ab0dec80be8b857ddf5d1f8df7b41a7aa540cdea71de7dc52d90d8a8a
SHA3-384 hash: 1f57bd653c7e6b21c1c8f4a4cb2977b66722c2ea42db8c27cbd08e50506c6e616de8e8b922568efe121fb5b84d12b3bd
SHA1 hash: df9bc864457b890d12f909b3ae4277326fe24394
MD5 hash: 7875977da9bd958ebba147140ac30a7a
humanhash: stairway-tango-black-nuts
File name:SKM__C20192910887888001990.pdf.r00
Download: download sample
Signature MassLogger
Create hunting rule
File size:1'053'479 bytes
First seen:2020-11-05 09:44:12 UTC
Last seen:2020-11-05 15:49:01 UTC
File type: r00
MIME type:application/x-rar
ssdeep 24576:jl8ztgKjy0ZhQmVi0h/Fqxi1TYj3KKjM/6qbX4SUc3zDrARx:jeSl76Fq0TQKv1ISUc0X
TLSH 8D25330E0C802C154D8761AC9B85EF814BC95F7FB8816CFB9DDD81E8295BC662E19CF9
Reporter abuse_ch
Tags:geo MassLogger r00 TUR


Avatar
abuse_ch
Malspam distributing MassLogger:

HELO: esamakine.com.tr
Sending IP: 180.214.236.23
From: Eda HACIHALİLOĞLU ESA <edahacihaliloglu@esamakine.com.tr>
Subject: RE: yeni sipariş
Attachment: SKM__C20192910887888001990.pdf.r00 (contains "SKM__C20192910887888001990.pdf.exe")

Intelligence

File Origin
# of uploads :
2
# of downloads :
99
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c1089d2ab0dec80be8b857ddf5d1f8df7b41a7aa540cdea71de7dc52d90d8a8a/
Threat name:
ByteCode-MSIL.Backdoor.Androm
Create hunting rule
Status:
Malicious
First seen:
2020-11-05 04:12:41 UTC
AV detection:
14 of 28 (50.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=yeej2kvq33eax2fyk7o7lupy355udj5kkqgn5jy547offwinrkfa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

r00 c1089d2ab0dec80be8b857ddf5d1f8df7b41a7aa540cdea71de7dc52d90d8a8a

(this sample)

MassLogger

Executable exe ca18e92f0eb610f92ce008b708acdca5969f308e319f5f128099514948dbd808

  
Dropping
MD5 821588141f7c3924556263205d554729
  
Dropping
MassLogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ca18e92f0eb610f92ce008b708acdca5969f308e319f5f128099514948dbd808

Comments