MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d90fe9930af088f5abaec41a10587ecbc0b94e6941d3f54e118b2f9721009091. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d90fe9930af088f5abaec41a10587ecbc0b94e6941d3f54e118b2f9721009091
SHA3-384 hash: 7266711fbd005db296e563729eb68334b4d0e945938416d080bbaec19b9c7d067a494fbd8e850a413b2941ec5dbbec31
SHA1 hash: d0c149bca2e6bac15e4c5b97176a4e15a2c846d5
MD5 hash: 6eeda40223aa3c9acc60a20e3b44728e
humanhash: comet-chicken-lemon-alanine
File name:attched.zip
Download: download sample
Signature MassLogger
Create hunting rule
File size:725'647 bytes
First seen:2020-10-09 06:35:57 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:P5i+38V49BGLm+Li+rx7y0R5/bBlTwuKTRWfN/ahsHKQEZcDV:P5ii648Lj80R5TTOTY0ZW
TLSH 86F4238BB238675D7D4004DE144B5BEE6670594B3BC6CBFA7FEA11D00578CC7AA08CA9
Reporter abuse_ch
Tags:MassLogger zip


Avatar
abuse_ch
Malspam distributing MassLogger:

HELO: ESSAR.COM
Sending IP: 107.173.40.220
From: ROBIN KEDIR<INFO@ESSAR.COM>
Subject: RE: RFQ for supply of Piping Fittings oil and maritime equipments as attached.
Attachment: attched.zip (contains "attched.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
89
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d90fe9930af088f5abaec41a10587ecbc0b94e6941d3f54e118b2f9721009091/
Threat name:
Win32.Trojan.LokiBot
Create hunting rule
Status:
Malicious
First seen:
2020-10-09 01:10:25 UTC
AV detection:
20 of 26 (76.92%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=3eh6teyk6ceplk5oyqnbawd6zpalsttjihj7ktqrrmxzoiiasciq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Lokibot
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d90fe9930af088f5abaec41a10587ecbc0b94e6941d3f54e118b2f9721009091

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

zip d90fe9930af088f5abaec41a10587ecbc0b94e6941d3f54e118b2f9721009091

(this sample)

MassLogger

Executable exe 383422deddf4a90f0a8595727fd85959a847ee602eaf4a460e9cc27c751e26e5

  
Dropping
MD5 8c1df7d382218821c83b79afd1899ae1
  
Dropping
MassLogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 383422deddf4a90f0a8595727fd85959a847ee602eaf4a460e9cc27c751e26e5

Comments