MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e72bd1fabcf4a317b2c121567315e7f5a33ae12ea6194255f554f096e8d107ac. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e72bd1fabcf4a317b2c121567315e7f5a33ae12ea6194255f554f096e8d107ac
SHA3-384 hash: 93cbe6259753b8731b34ed24a4d10f9523caac560ffebac2cb6fd5a4524621a37d34e08f3d70ad5f0030150a5fbe5754
SHA1 hash: 88be84289182eb31cd5074b7bae9d62d40c9b2c7
MD5 hash: 45468537afcadc8fb43000f4b50371f3
humanhash: bulldog-kentucky-zebra-golf
File name:Drawings and BOQ.PDF.gz
Download: download sample
Signature MassLogger
Create hunting rule
File size:808'282 bytes
First seen:2020-08-05 09:25:35 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 24576:i73s6a1Pr0Gkiq0KbhMQ4YhewVIUnmQybcOq:iw5rXXKb2YEwqwm31q
TLSH DB0533D91477495E87EE2BCE97963ABFBBD37A8950B34704210E8582988CC5C1D4BFC2
Reporter abuse_ch
Tags:gz MassLogger


Avatar
abuse_ch
Malspam distributing MassLogger:

HELO: host.qualifairs.com
Sending IP: 85.25.130.41
From: davidraph@mweb.co.za
Subject: Finance application documents
Attachment: Drawings and BOQ.PDF.gz (contains "Drawings and BOQ.PDF.exe")

MassLogger C2:
http://www.mehmethilmieren.com/wp/panel/

Intelligence

File Origin
# of uploads :
1
# of downloads :
60
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e72bd1fabcf4a317b2c121567315e7f5a33ae12ea6194255f554f096e8d107ac/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-08-05 09:27:08 UTC
AV detection:
10 of 48 (20.83%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=44v5d6v46srrpmwbeflhgfph6wrtvyjouymuevpvktyjn2gra6wa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e72bd1fabcf4a317b2c121567315e7f5a33ae12ea6194255f554f096e8d107ac

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

gz e72bd1fabcf4a317b2c121567315e7f5a33ae12ea6194255f554f096e8d107ac

(this sample)

MassLogger

Executable exe 61ec5ccd0f1a6f9ef49ca93d9ee6aab8bfcb85ff06a7e5056375dbc994304ae2

  
Dropping
MD5 38623164c45a19e8e2f9cebda4cf1acf
  
Dropping
MassLogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 61ec5ccd0f1a6f9ef49ca93d9ee6aab8bfcb85ff06a7e5056375dbc994304ae2

Comments