MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fa55550d9860d0d68fa85601f81429771ba78abb71bb37ae5e3ca71ce00df4fd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fa55550d9860d0d68fa85601f81429771ba78abb71bb37ae5e3ca71ce00df4fd
SHA3-384 hash: 4ec38b0682c970f4a50a445e4f242b64206054706e54cd9bd94407c0e2dd6205b19e3f6b595334b30d4cbd99d9545cec
SHA1 hash: b725c8e6a6ad45fed46fde6ee1276cfdc8a01ee1
MD5 hash: f914195093535531ce1cdf5f1ab36b3c
humanhash: arkansas-seven-thirteen-eleven
File name:SCTB 372PO.rar
Download: download sample
Signature MassLogger
Create hunting rule
File size:931'493 bytes
First seen:2020-08-13 12:18:57 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 24576:NIJR/LUgTbl/TX9OTrcqxrI4393y/+qBwB2Bc/wDg:NI3/LUAblLCx0K93y/+MwB24H
TLSH 5C1523FA63DDA380FF725BCA1D0955F9FC9787A552AC1D43A3B6873808DA40336B4189
Reporter abuse_ch
Tags:MassLogger rar


Avatar
abuse_ch
Malspam distributing MassLogger:

HELO: s111-ir-cpanel-trade.maindns.net
Sending IP: 185.165.116.18
From: SU GÜLISTAN <info@bestcelikkapi.com.tr>
Reply-To: purchase@bestcelikkapi.com.tr
Subject: New Order -PO #[SCTB] -372
Attachment: SCTB 372PO.rar (contains "SCTB 372PO.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
64
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fa55550d9860d0d68fa85601f81429771ba78abb71bb37ae5e3ca71ce00df4fd/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-08-13 12:20:08 UTC
AV detection:
20 of 47 (42.55%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=7jkvkdmymdinnd5ikya7qfbjo4n2pcv3og5tpls6hstrzyan6t6q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/fa55550d9860d0d68fa85601f81429771ba78abb71bb37ae5e3ca71ce00df4fd

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

rar fa55550d9860d0d68fa85601f81429771ba78abb71bb37ae5e3ca71ce00df4fd

(this sample)

MassLogger

Executable exe 20be971374f0ffd1224aafed410fdb30e3340788a7dd80747dd18f3ef0f8168d

  
Dropping
MD5 2fc4ae133b83bdf318dfc6d5a06d189c
  
Dropping
MassLogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 20be971374f0ffd1224aafed410fdb30e3340788a7dd80747dd18f3ef0f8168d

Comments