MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c57d489dde7191aeb22a445bd4c49fc3c9823b560f4e5fcc06de36375a79e610. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c57d489dde7191aeb22a445bd4c49fc3c9823b560f4e5fcc06de36375a79e610
SHA3-384 hash: ec3b898c4e9ed92c9a53c47fdff65370fe746cd0cf420816b0889ee1b49697d78e35ef89c05101f2a04dd7c6cb5a2ab4
SHA1 hash: 134e6e4c7e401c10842779a4aa26a01371d2a490
MD5 hash: 45a5f51d11641006549a79c4183505d4
humanhash: yellow-snake-white-aspen
File name:DHL_January 2021 at 28M_9B7290_PDF.z.zip
Download: download sample
Signature MassLogger
Create hunting rule
File size:608'170 bytes
First seen:2021-01-14 20:07:03 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:zimTArku8ngmGwtycnTMMRSM4mSYulUYWJgy3VPru4I43yt3g5QMuz:2mMrkkC3TMQSM4mSllUgQu4Ww+Dz
TLSH 13D433A60307F323E70C6A7D4C0A0EB061CB4D13DB9EDDDF2317DFAE196295A2945698
Reporter abuse_ch
Tags:DHL MassLogger zip


Avatar
abuse_ch
Malspam distributing MassLogger:

HELO: 023.gestiondealojamiento.com
Sending IP: 193.42.143.82
From: DHL Customer Support <noreply@dhl.com>
Subject: RE: DHL Express Shipment // AWB_5011014
Attachment: DHL_January 2021 at 28M_9B7290_PDF.z.zip (contains "DHL_January 2021 at 28M_9B7290_PDF.exe")

MassLogger SMTP exfil server:
mail.beljemi.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
158
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_badexts14.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c57d489dde7191aeb22a445bd4c49fc3c9823b560f4e5fcc06de36375a79e610/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-01-14 20:07:08 UTC
AV detection:
13 of 46 (28.26%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=yv6urho6ogi25mrkirn5jre7ypeyeo2wb5hf7tag3y3dowtz4yia._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c57d489dde7191aeb22a445bd4c49fc3c9823b560f4e5fcc06de36375a79e610

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

zip c57d489dde7191aeb22a445bd4c49fc3c9823b560f4e5fcc06de36375a79e610

(this sample)

MassLogger

Executable exe 2d9b9f417d914d2b6f3bc2eefbe9b82ec3eacd8077f2ad4a1a05f393f8584bc8

  
Dropping
MD5 c13081675ef4f1fea467c18c31bf2492
  
Dropping
MassLogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 2d9b9f417d914d2b6f3bc2eefbe9b82ec3eacd8077f2ad4a1a05f393f8584bc8

Comments