MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d4d8aaba48fe5c94db1696f2b12693df0dbf056b5ef672049bb90d8c160d6a24. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d4d8aaba48fe5c94db1696f2b12693df0dbf056b5ef672049bb90d8c160d6a24
SHA3-384 hash: 1441bc1176605efc788bca3ef796f0e922eafa400c36ffbb4e85aa1bb6d39b85cb1a2e7bcb1d35a46ef685d7d5f15c2c
SHA1 hash: a30b8e32a3a07850f637a472081323c8f08ccb53
MD5 hash: e0fbfde4549627cf4b3e3535aa2bd9a6
humanhash: illinois-king-alanine-winner
File name:PO4500015946.pdi
Download: download sample
Signature MassLogger
Create hunting rule
File size:684'987 bytes
First seen:2020-08-18 12:33:05 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:ybhoI4/tS1e/g5XoRK9jrD8nO4wZ2R509UzoKFlJkUheV/gASAPNsD:KheSiKNT4wZKnzTFbNh6/RlPNm
TLSH 58E4332A9CF56AF28814A5B3ACA2E71F379E27EBF0E800111D09C77E0949ED17E45537
Reporter abuse_ch
Tags:MassLogger pdi


Avatar
abuse_ch
Malspam distributing MassLogger:

HELO: smtp119.iad3a.emailsrvr.com
Sending IP: 173.203.187.119
From: info@dichemfoods.gr <info@dichemfoods.gr>
Reply-To: s.margeta@dichemfoods-gr.com
Subject: Re: QUOTE
Attachment: PO4500015946.pdi (contains "PO4500015946.exe")

MassLogger SMTP exfil server:
frostdell.uk:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.BackDoor.RatNET.2.27528.17296.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d4d8aaba48fe5c94db1696f2b12693df0dbf056b5ef672049bb90d8c160d6a24/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-08-18 12:34:12 UTC
AV detection:
29 of 48 (60.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=2tmkvosi7zojjwyws3zlcjut34g36blll33hebe3xegyyfqnnisa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Tinba
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d4d8aaba48fe5c94db1696f2b12693df0dbf056b5ef672049bb90d8c160d6a24

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

zip d4d8aaba48fe5c94db1696f2b12693df0dbf056b5ef672049bb90d8c160d6a24

(this sample)

MassLogger

Executable exe fc03d41d9bac8d78e1d829039f24f2f7066ded44a70c4126045c553015bbe957

  
Dropping
MD5 382276d6658a59ab571cf5c314733990
  
Dropping
MassLogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 fc03d41d9bac8d78e1d829039f24f2f7066ded44a70c4126045c553015bbe957

Comments