MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d9a2df6be446befa12555298a0e52c7b5e2cd13f5565873bd5caab1dbaf6cde4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d9a2df6be446befa12555298a0e52c7b5e2cd13f5565873bd5caab1dbaf6cde4
SHA3-384 hash: a5003ff3a114d63bdbd8e3fb16e96fd2b23dd005c64ae062a6542a777711d10e723f2ad7325a35b8ae1994165fd12c7f
SHA1 hash: 63ed1f8e7fb57ae1f288618c4c4fd49a8c0263c9
MD5 hash: f6fa3500a9c5fc87eaf959d35b2d53d2
humanhash: cold-november-bacon-social
File name:Miriam Stoppard cv.zip
Download: download sample
Signature MassLogger
Create hunting rule
File size:714'950 bytes
First seen:2020-10-23 08:53:52 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:v0FIUVpf2I4Qb/lIS4JbiJJgJmz/SxVh5gLmBqcVo9f9k8i2U+7r8DEYGI3xkaC:v0iUvKMCpgSxpgIqc64R4P8SI3xBC
TLSH 87E423B9469D9292A19B23D3F15ABA11E5B334D0E27740DEAE0393FB6DDD718442C0EC
Reporter abuse_ch
Tags:MassLogger zip


Avatar
abuse_ch
Malspam distributing MassLogger:

HELO: yahoo.com
Sending IP: 156.96.118.35
From: Miriam Stoppard <Miriamstopp@yahoo.com>
Subject: Accountant with Experience
Attachment: Miriam Stoppard cv.zip (contains "chibyke03.exe")

MassLogger SMTP exfil server:
mail.hkoffice365.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
86
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.BackDoor.SpyBotNET.25.31832.32.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d9a2df6be446befa12555298a0e52c7b5e2cd13f5565873bd5caab1dbaf6cde4/
Threat name:
Win32.Trojan.LokibotCrypt
Create hunting rule
Status:
Malicious
First seen:
2020-10-23 07:29:15 UTC
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=3grn627ei27puesvkkmkbzjmpnpczuj7kvsyoo6vzkvr3oxwzxsa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

zip d9a2df6be446befa12555298a0e52c7b5e2cd13f5565873bd5caab1dbaf6cde4

(this sample)

MassLogger

Executable exe 8e351736ae4bff938f1b59b396f039a6a281c4b8401f918f6b7b52b5c574d330

  
Dropping
MD5 d9d969b4d51b61c1f2e62305fcb8ba1b
  
Dropping
MassLogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8e351736ae4bff938f1b59b396f039a6a281c4b8401f918f6b7b52b5c574d330

Comments