MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 de9bf2616d90ec71115f5704bf2a064f3665861bfce6fc6a7b95f6675decf0c0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: de9bf2616d90ec71115f5704bf2a064f3665861bfce6fc6a7b95f6675decf0c0
SHA3-384 hash: 3b678de473daf6201e376a23aad1c34f1d5ff641c0fc7b5660e83b31539b4ce8ea2d5436e66699246f66195b83ba0da6
SHA1 hash: c3bcfd5b9dd40044ed2a89acc0c7ec260244b2d2
MD5 hash: 9b34ca3198edf0a64eb6a36cc1394d69
humanhash: queen-september-fanta-zebra
File name:Ziraat Ba..esaji pdf.rar
Download: download sample
Signature MassLogger
Create hunting rule
File size:976'290 bytes
First seen:2020-08-31 05:58:17 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 24576:wAWkxu3fK4amCwFSzl0OsWts9OsXzKKBOWeS+eL:wAWiuvjaqF+01WS93XFBOWeeL
TLSH 932533A1F0B19114347A4271BD983B3421E7069680FB7CF5E3E589D9F34ADAA1B788D3
Reporter abuse_ch
Tags:geo MassLogger rar TUR ZiraatBank


Avatar
abuse_ch
Malspam distributing MassLogger:

HELO: mail.ertenler.com.tr
Sending IP: 185.46.55.59
From: ZIRAAT BANKASI <teknik6@ertenler.com.tr>
Subject: 5000, EUR Swift Bildirimi
Attachment: Ziraat Ba..esaji pdf.rar (contains "8888888888.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
82
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/de9bf2616d90ec71115f5704bf2a064f3665861bfce6fc6a7b95f6675decf0c0/
Threat name:
Win32.Trojan.Zusy
Create hunting rule
Status:
Malicious
First seen:
2020-08-30 21:13:36 UTC
AV detection:
10 of 48 (20.83%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=32n7eylnsdwhcek7k4cl6kqgj43glbq37ttpy2t3sx3goxpm6daa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/de9bf2616d90ec71115f5704bf2a064f3665861bfce6fc6a7b95f6675decf0c0

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

rar de9bf2616d90ec71115f5704bf2a064f3665861bfce6fc6a7b95f6675decf0c0

(this sample)

MassLogger

Executable exe 3a47c3d7fb87119788726fbd3cc8962ef88a9c8ad11ec066250d38eddf1dd301

  
Dropping
MD5 3cf0adfd6dc4b21422fe227b3fb4632d
  
Dropping
MassLogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3a47c3d7fb87119788726fbd3cc8962ef88a9c8ad11ec066250d38eddf1dd301

Comments