MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ef135ff370965b368d1a590d09638e105809bfcf3696a754ce8945de0a574c37. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ef135ff370965b368d1a590d09638e105809bfcf3696a754ce8945de0a574c37
SHA3-384 hash: 6b2a814451ac70c467b2f459b26073c5c247b92e427e36a50c75274af98e9a85e7a5d4381f1f11c2c46299a21b383fc3
SHA1 hash: 1640eccea9f93d18c4db3bc061ea25ee984e3c99
MD5 hash: 788335a0391e4b1a8547bb353116205c
humanhash: tennessee-earth-king-wyoming
File name:DHL SHIPPING DOCUMENT.z
Download: download sample
Signature MassLogger
Create hunting rule
File size:880'768 bytes
First seen:2020-07-01 16:10:33 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:s5RH9ecpmjUlu+XCCQ29pCjOHGZycU6Pe9R8D:sz9ePjYh229pC6mZsiQ0
TLSH 5015330B834E23F2EB5F8D4FE84D84E94EB9AC5CEC415A4019D5FF5895BFD09C00A666
Reporter abuse_ch
Tags:DHL MassLogger z


Avatar
abuse_ch
Malspam distributing MassLogger:

HELO: vps.signform-pl.me
Sending IP: 45.95.169.216
From: DHL Express logistics <eg.tracing@dhl.com>
Subject: Fwd: RE: URGENT::::DHL tracking no 4680921932
Attachment: DHL SHIPPING DOCUMENT.z (contains "DHL SHIPPING DOCUMENT.exe")

MassLogger SMTP exfil server:
mail.elkat.com.my:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
78
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Artemis1E9264B9A941.15893.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ef135ff370965b368d1a590d09638e105809bfcf3696a754ce8945de0a574c37/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-07-01 13:08:12 UTC
AV detection:
22 of 48 (45.83%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=54jv743qszntndi2legqsy4ocbmatp6pg2lkovgorfc54csxjq3q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

zip ef135ff370965b368d1a590d09638e105809bfcf3696a754ce8945de0a574c37

(this sample)

MassLogger

Executable exe 60464dbfb4a5cb7227d3afe20367adb84757365e1b9a466ef95c0c96c28b31cf

  
Dropping
MD5 1e9264b9a9412d1de2a4ddf9d062f9d9
  
Dropping
MassLogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 60464dbfb4a5cb7227d3afe20367adb84757365e1b9a466ef95c0c96c28b31cf

Comments