MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ddcf5bf2e778c3de80e61f8729606592e37dbe8e90b8b3dc22d61d40f3b12286. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ddcf5bf2e778c3de80e61f8729606592e37dbe8e90b8b3dc22d61d40f3b12286
SHA3-384 hash: 999e2e053d8898ef79960ec0cdd85810f3a765baa069b89e2f92d2c1ae537092ea27bcd1abe00f73b315cfc0f44671cb
SHA1 hash: 5378655c49cf08f870b4de9495fe9e1ac7b1fd42
MD5 hash: d0dae4e4d450260e5707379593218fe3
humanhash: echo-equal-utah-freddie
File name:BILL OF LANDING DRAFT COMMERCIAL INVOICE ISO CERTIFICATE PO-RTM54379326.PDF.r15
Download: download sample
Signature MassLogger
Create hunting rule
File size:915'734 bytes
First seen:2020-10-08 17:48:50 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 24576:Rr2TLfVC/0guWb96Jms6ZBC1TmmBrbLFj2vN:N2TLfnWbJZcYmBrRg
TLSH 5F15336D206552DF7F8052D63DFBF860B1296D398DB314AC6A7039721FB94182ECA873
Reporter abuse_ch
Tags:MassLogger r15


Avatar
abuse_ch
Malspam distributing MassLogger:

HELO: dhl.com
Sending IP: 45.11.19.149
From: "Amit Matalia" <amatalia@dhl.com>
Reply-To: backoficemarnavalarcelomital.co@bk.ru
Subject: FW: Dhl Shiping Doc 2020-10- (2) - Page 1
Attachment: BILL OF LANDING DRAFT COMMERCIAL INVOICE ISO CERTIFICATE PO-RTM54379326.PDF.r15 (contains "BILL OF LANDING DRAFT COMMERCIAL INVOICE & ISO CERTIFICATE PO-RTM54379326.PDF.exe")

MassLogger SMTP exfil server:
mail.zarkom.rs:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
112
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ddcf5bf2e778c3de80e61f8729606592e37dbe8e90b8b3dc22d61d40f3b12286/
Threat name:
ByteCode-MSIL.Infostealer.Stelega
Create hunting rule
Status:
Malicious
First seen:
2020-10-08 17:50:07 UTC
AV detection:
18 of 29 (62.07%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=3xhvx4xhpdb55ahgd6dssydfslrx3puosc4lhxbc2youb45rekda._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/ddcf5bf2e778c3de80e61f8729606592e37dbe8e90b8b3dc22d61d40f3b12286

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

rar ddcf5bf2e778c3de80e61f8729606592e37dbe8e90b8b3dc22d61d40f3b12286

(this sample)

MassLogger

Executable exe 8c3ea92bf0620d3126691eb0d463418170b88034e40dab26e8049ea5ceefd1f1

  
Dropping
MD5 cd50dc012cf01749b236f46d8319151a
  
Dropping
MassLogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8c3ea92bf0620d3126691eb0d463418170b88034e40dab26e8049ea5ceefd1f1

Comments