MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c5008566d9e1eb953af1a60ba85ec70b6f523570d196b229993aa539c2e32fda. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c5008566d9e1eb953af1a60ba85ec70b6f523570d196b229993aa539c2e32fda
SHA3-384 hash: 1620b54ff0e009918d680cb8e7c20dedece04d429704ad7f4207c4d8f3e59a2ee2c42bee34b5ee94adefc4bef1cb359b
SHA1 hash: f53e36c7605616e23a73ad2b57852592f773f77d
MD5 hash: 0a0d4fba0597b1a44dd7ed363a2ff12c
humanhash: hydrogen-helium-one-venus
File name:New Purchase Order.rar
Download: download sample
Signature MassLogger
Create hunting rule
File size:780'595 bytes
First seen:2020-08-05 13:07:26 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:U3QFffBag8KoADmFVc6m23o8ryx+GOqH4mv0xqahj/xMnNgql+GBn5RkKaLa:TBWP66mGV+x+GOqSxlLizBn5KKaLa
TLSH 6BF433E1D54F348B8921BE7DF27E8C609B30C2616498022DAD5C7F901F7B86747AC76A
Reporter abuse_ch
Tags:MassLogger rar


Avatar
abuse_ch
Malspam distributing MassLogger:

HELO: rdns0.hal-lndia.co.in
Sending IP: 5.188.93.228
From: Herbert Markowitsch<sales@hal-lndia.co.in>
Subject: New Purchase Order
Attachment: New Purchase Order.rar (contains "RFQ- Bitumen 6070.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
64
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c5008566d9e1eb953af1a60ba85ec70b6f523570d196b229993aa539c2e32fda/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-08-05 13:09:06 UTC
AV detection:
20 of 48 (41.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=yuaikzwz4hvzkoxruyf2qxwhbnxvenlq2gllekmzhksttqxdf7na._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/c5008566d9e1eb953af1a60ba85ec70b6f523570d196b229993aa539c2e32fda

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

rar c5008566d9e1eb953af1a60ba85ec70b6f523570d196b229993aa539c2e32fda

(this sample)

MassLogger

Executable exe 2aa941b7340367ad780683ac45b75f8e63b4df7913b4ca6f95e794fd75b36b03

  
Dropping
MD5 a5e824a9cb639819423db96435b40b01
  
Dropping
MassLogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 2aa941b7340367ad780683ac45b75f8e63b4df7913b4ca6f95e794fd75b36b03

Comments