MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d2232949a80b21e9c967490be35b87ba8e5495cb61b10493b5adb1297e37dd4b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d2232949a80b21e9c967490be35b87ba8e5495cb61b10493b5adb1297e37dd4b
SHA3-384 hash: 50b46b1dc21638507e55937efd7302c7ff65527ac69c73f9c45743e38b487430fcfec9e0640c6cb83cfffa64d98f6f66
SHA1 hash: a63e0a6618a8b903e9900db119136d56f77f1fa0
MD5 hash: bfc8444d4b0deb93a43c249db026f48a
humanhash: wyoming-jersey-seventeen-hotel
File name:Neptune_028887E.iso
Download: download sample
Signature MassLogger
Create hunting rule
File size:1'554'432 bytes
First seen:2020-07-20 10:41:17 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:QPMfUaGWFxd6No/NtLyIsG5EypNbv7sUyzO2kTCvZOEAXEJaCvr3tasND:z8TkdTs1ipv7sfj+wOVXSaCxas
TLSH E3753A3A35C29819C92C1A75843895C0B6E567463B63CF1EE1AF530E5E03B6F7B424EE
Reporter abuse_ch
Tags:iso MassLogger


Avatar
abuse_ch
Malspam distributing MassLogger:

HELO: essilor.dk
Sending IP: 37.49.230.253
From: Katrena YALDA <katrena.yalda@essilor.dk>
Subject: Inquiry_AOS Neptune_028887E
Attachment: Neptune_028887E.iso (contains "Neptune_028887E.exe")

MassLogger SMTP exfil server:
mail.privateemail.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
64
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d2232949a80b21e9c967490be35b87ba8e5495cb61b10493b5adb1297e37dd4b/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-07-20 10:43:05 UTC
AV detection:
18 of 48 (37.50%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=2irsssnibmq6tslhjef6gw4hxkhfjfolmgyqje5vvwyss7rx3vfq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legal
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/d2232949a80b21e9c967490be35b87ba8e5495cb61b10493b5adb1297e37dd4b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

iso d2232949a80b21e9c967490be35b87ba8e5495cb61b10493b5adb1297e37dd4b

(this sample)

MassLogger

Executable exe 8ba2916d91cfaa19c67d2e8a9603fca8a41fac3f960b79edcadab0bb094c3e52

  
Dropping
MD5 8dff4b620965db5895629bc5e4733154
  
Dropping
MassLogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8ba2916d91cfaa19c67d2e8a9603fca8a41fac3f960b79edcadab0bb094c3e52

Comments