MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ce192b9c62844c85fcd685c55be57fe65360fe550e512df1aa62bb6bc1d35ac6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ce192b9c62844c85fcd685c55be57fe65360fe550e512df1aa62bb6bc1d35ac6
SHA3-384 hash: 21e7c7eb84d21326ce3801dcf4bb4c856bcc07e745f743d1102897d1bebd5bfa7d838be9d1d6a9040c7e3e14553fd9d9
SHA1 hash: d3e846c51034c3017f0a50895d4330bff8c5339c
MD5 hash: 75e6a9d23644c46d848a23b59a6af65f
humanhash: freddie-fourteen-bulldog-music
File name:KYMVDH2001015_pdf.gz
Download: download sample
Signature MassLogger
Create hunting rule
File size:642'583 bytes
First seen:2020-10-14 15:20:50 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 12288:0jyOBEhLR9y/+5IL2BuuvOGlWF48d4hQPPpkFQPOTFKuzur/f:0zQIMIL2B5vZ6dpPOVurn
TLSH 4AD423C9ECB019508282D7F2F791AEEB112F861A1385EB73B17BB40D52276011DEBB1D
Reporter abuse_ch
Tags:gz MassLogger


Avatar
abuse_ch
Malspam distributing MassLogger:

HELO: othman13.genious.net
Sending IP: 41.77.116.175
From: m.chmima@promark.ma
Subject: Fwd: RE: Déplacement IFRANE - MERCREDI 14-10-20
Attachment: KYMVDH2001015_pdf.gz (contains "KYMVDH2001015 川泰_pdf.exe")

MassLogger SMTP exfil server:
bh-58.webhostbox.net:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27382.Rar5Heur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ce192b9c62844c85fcd685c55be57fe65360fe550e512df1aa62bb6bc1d35ac6/
Threat name:
Win32.Packed.Generic
Create hunting rule
Status:
Suspicious
First seen:
2020-10-14 07:06:46 UTC
AV detection:
8 of 48 (16.67%)
Threat level:
  1/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=zymsxhdcqrgil7gwqxcvxzl74zjwb7svbzis34nkmk5wxqotllda._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/ce192b9c62844c85fcd685c55be57fe65360fe550e512df1aa62bb6bc1d35ac6

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

gz ce192b9c62844c85fcd685c55be57fe65360fe550e512df1aa62bb6bc1d35ac6

(this sample)

MassLogger

Executable exe 1d3286d29155618ebaf43cfebc809f80daa7d247b9e3c872ea5c48c8109afcd0

  
Dropping
MD5 6b66331469a22a562a7c89684b0f747c
  
Dropping
MassLogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1d3286d29155618ebaf43cfebc809f80daa7d247b9e3c872ea5c48c8109afcd0

Comments