MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fb5e7c364ac02ee8e38fc581a3660f2abc8f5a78bbdab8df10f2042b13cc2e71. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fb5e7c364ac02ee8e38fc581a3660f2abc8f5a78bbdab8df10f2042b13cc2e71
SHA3-384 hash: 3828f694be6c990d6f40ba97449a02546dd72c27f75804a01bf561eddf1fe523952a3e4e575a68ad816e945db3c25afb
SHA1 hash: ad30380b754aa59fd1b9dfe2c1e5dd691e615319
MD5 hash: cc5c695391bd12d653e5b1453de8d9a5
humanhash: oklahoma-six-blossom-fourteen
File name:invoice packing-list PDF.rar
Download: download sample
Signature MassLogger
Create hunting rule
File size:675'997 bytes
First seen:2020-10-07 04:53:34 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:gGEz7rReTBwPNQfZqSURVEdtVPcER64hlSWB/GZQ1c+Ih4mFR4G460f/jVFpY6hN:gGE1eTBta6jPjR6430+grFR4GOfb3pYk
TLSH D4E4232DD94E50B2E1711A3065632B7E4A4B2F1105B76E9E37F2AE39604CED30D718EB
Reporter abuse_ch
Tags:DHL MassLogger rar


Avatar
abuse_ch
Malspam distributing MassLogger:

HELO: server.nazarweb.org
Sending IP: 93.187.207.112
From: DHL International <abaran@diyarbakiroto.com.tr>
Reply-To: <donatella@fabiorusconi.it>
Subject: Re: Your Shipment invoice & packing-list
Attachment: invoice packing-list PDF.rar (contains "manmanman.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
72
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fb5e7c364ac02ee8e38fc581a3660f2abc8f5a78bbdab8df10f2042b13cc2e71/
Threat name:
Win32.Trojan.Zusy
Create hunting rule
Status:
Malicious
First seen:
2020-10-07 00:06:56 UTC
AV detection:
8 of 48 (16.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=7nphynskyaxory4pywa2gzqpfk6i6wtyxpnlrxyq6iccwe6mfzyq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/fb5e7c364ac02ee8e38fc581a3660f2abc8f5a78bbdab8df10f2042b13cc2e71

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

rar fb5e7c364ac02ee8e38fc581a3660f2abc8f5a78bbdab8df10f2042b13cc2e71

(this sample)

MassLogger

Executable exe 0adc7e74c78f1d91fa1972467bdee948477ade15409a3f2924f337de4038ded1

  
Dropping
MD5 f3fa5a2bd3f5dfed8968dbe83e2ba8a3
  
Dropping
MassLogger
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0adc7e74c78f1d91fa1972467bdee948477ade15409a3f2924f337de4038ded1

Comments