🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 01ad626abefeb19a1fd65ec27599b6cdc0d025dc42261317e77480860ffa7a09. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 14


Intelligence 14 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 01ad626abefeb19a1fd65ec27599b6cdc0d025dc42261317e77480860ffa7a09
SHA3-384 hash: 7ec543ba3949522f12b56cf44d4da7dcc9ac72718ead11b011a6c85d9202d514501dfa64faecaed71e1b77c3a6ce2bd1
SHA1 hash: be70dbedfd79d3d7e3146e08cdbec5701329c39b
MD5 hash: c023f0fd63a3ed5d50299d7aa4af1e9a
humanhash: south-seven-michigan-beer
File name:01ad626abefeb19a1fd65ec27599b6cdc0d025dc42261317e77480860ffa7a09
Download: download sample
Signature MassLogger
Create hunting rule
File size:864'768 bytes
First seen:2026-08-10 14:40:10 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'298 x AgentTesla, 20'717 x Formbook, 12'402 x SnakeKeylogger)
ssdeep 12288:vxxltnn0gGfnQkfXfFRp1z2VXXFNOX8vlZk4ZfMce8+6m51IPB0/Dsn:vp50bQkfXdRpleX1JOM0ceMmk0/Yn
TLSH T12D05F1151316DA41E0E68BFAB8A0D37533790DCF7AE2C3969FE96FFB38153805558282
TrID 73.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
6.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.6% (.EXE) Win64 Executable (generic) (6522/11/2)
4.5% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter adrian__luca
Tags:exe MassLogger

Intelligence

File Origin
# of uploads :
1
# of downloads :
76
Origin country :
HU HU
Vendor Threat Intelligence
Malware configuration found for:
RoboSki
Details
Link:
https://research.acce.ciphertechsolutions.com/results/44a5944a-69ab-4290-8752-e63840b7e4bc/
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/79970/
Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ac51a7431656ca03ff0cc19
Tags:
micro shell msil
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Сreating synchronization primitives
Creating a process with a hidden window
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Creating a file in the %temp% directory
Launching a process
Creating a file
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Adding an exclusion to Microsoft Defender
Unauthorized injection to a system process
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
obfuscated packed vbnet
Link:
https://www.filescan.io/uploads/6a79e2e25ca504a8496e31df/reports/d72b9227-0104-40e1-8660-1e6ac7556fbb/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/01ad626abefeb19a1fd65ec27599b6cdc0d025dc42261317e77480860ffa7a09
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-07-21T04:44:00Z UTC
Last seen:
2026-08-02T08:30:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/01ad626abefeb19a1fd65ec27599b6cdc0d025dc42261317e77480860ffa7a09/results?tab=lookup
Gathering data
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/01ad626abefeb19a1fd65ec27599b6cdc0d025dc42261317e77480860ffa7a09
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/01ad626abefeb19a1fd65ec27599b6cdc0d025dc42261317e77480860ffa7a09/
Threat name:
Win32.Backdoor.Remcos
Create hunting rule
Status:
Malicious
First seen:
2026-07-21 09:06:56 UTC
File Type:
PE (.Net Exe)
Extracted files:
4
AV detection:
23 of 36 (63.89%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=agwwe2v672yzuh6wl3bhlgnwzxanajo4iitbgf7hosaimd72pieq._file
Verdict:
malicious
Label(s):
NovaStealer
Create hunting rule
Link:
https://reports.threatray.com/44b9c056-a268-456e-946f-30f0ab76543b
Result
Malware family:
masslogger
Create hunting rule
Score:
  10/10
Tags:
family:masslogger collection discovery execution persistence spyware stealer
Link:
https://tria.ge/reports/260810-r8l56s1dpa/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Adds Run key to start application
Looks up external IP address via web service
Checks computer location settings
Executes dropped EXE
Command and Scripting Interpreter: PowerShell
Family: MassLogger
Unpacked files
SH256 hash:
01ad626abefeb19a1fd65ec27599b6cdc0d025dc42261317e77480860ffa7a09
MD5 hash:
c023f0fd63a3ed5d50299d7aa4af1e9a
SHA1 hash:
be70dbedfd79d3d7e3146e08cdbec5701329c39b
Link:
https://www.unpac.me/results/4e19cadd-7e01-448c-82ec-8c7f3d701d0d/
SH256 hash:
e72f1fb80525d700de6585648574850a8b70666e0e2a78ada6d5d3d99ab3c871
MD5 hash:
a55038c97aec46e180736bd9ebe7849a
SHA1 hash:
14456f9e9723ce47d1b6df5ef6246e8c38ec9c2a
Link:
https://www.unpac.me/results/4e19cadd-7e01-448c-82ec-8c7f3d701d0d/
SH256 hash:
eaf25dd110bc91ee5000644e517678981138ff9508e011600ace6351cdc83241
MD5 hash:
36eab044ee9af604f7e28e3a7ee0f525
SHA1 hash:
5bc0592f374a05b9e2233d194902b88791555cc6
Detections:
win_404keylogger_g1
Create hunting rule
win_masslogger_w0
Create hunting rule
triage_snakekeylogger_infostealer
Create hunting rule
Link:
https://www.unpac.me/results/4e19cadd-7e01-448c-82ec-8c7f3d701d0d/
Parent samples :
d9e876c0ef78f0d6087d0c41c8d47ebe9fc8137055c9d74bbb7c1fd7fb8e1fdf
01ad626abefeb19a1fd65ec27599b6cdc0d025dc42261317e77480860ffa7a09
4a1b87430fe4ad7a1e9a35d99f7c612e7f2d8dce339edd172753aee1632653cc
416c02fdc82b8d6456f1e08a796a2347d1ac04ac35dfa67c898e4802678ff60c
40ef805fbbf333e9a2c47bf8ca3832dd854829da0a31469ec5fd271348b6fab4
687587baff7f25ded9f03274277f12b6d6a347af2238c3b32defc2736bc7023b
301a9e3b24f14798ed32be5de3dd802b4c13edc182bc1e29f80a40a1dcc2425e
519de0a4ed8131067f6364e3ae9f010d962f897e50fbdc7479f1325947b68525
1ccf47d19e5181c626bf6ad2bad6e95051a3281e9234b3202906bbd8aadd79a4
9db47d46c9411cef28cb767455f523c0ed8bfdb9cb6a087b665fdab87d7741eb
9cbc97f1e626ea10a3f415d31ba5a6e499012c57c487c23c5b3c7603806bd687
ad83577e425dfb5496897d25e3e4e7de8d7e100f4b0eacf1266eb9f12898fac8
387cb4924381a5ad1c522c44a53dc26c2a972597251ae85c9c60907dad666562
ff5bb9669cc476cdb2d6a61e628d475f8839de65661e36704d8c2a569db0fdc3
SH256 hash:
e4e98c56847f65b0ec79dd0fcd73f780be8e5b64a78def50b3d447c6a22aab6d
MD5 hash:
3e279146474e41a20e10d71196dea18c
SHA1 hash:
c3abd761f47fc10a6e546d214517de85e1cb64a0
Link:
https://www.unpac.me/results/4e19cadd-7e01-448c-82ec-8c7f3d701d0d/
Malware family:
PrivateLogger
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/01ad626abefe/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/79970/

Comments