MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0d38a21bfbe0279058f17dd10bafe3db801697f6528a67f79cb3f3ca483532ac. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

MassLogger

Vendor detections: 8

Intelligence 8 IOCs YARA 5 File information Comments

SHA256 hash:	0d38a21bfbe0279058f17dd10bafe3db801697f6528a67f79cb3f3ca483532ac
SHA3-384 hash:	88321019b601c8b1dc414b63db46c5063bb00a89eedf269d432a25e969478c296623b35a92d552e9e717e61d246914a9
SHA1 hash:	14249ac8df530ee1e7e084923641c0ccac02e283
MD5 hash:	b25f930cf98d13e17f871b429c6c6b33
humanhash:	cardinal-network-salami-william
File name:	PAYMENT TT COPY.PDF.z
Download:	download sample
Signature	MassLogger Create hunting rule
File size:	646'739 bytes
First seen:	2025-10-10 09:38:48 UTC
Last seen:	Never
File type:	z
MIME type:	application/x-rar
ssdeep	12288:JaNVZvIvKBESCD/53jJk6OeySWsHB5nJradmaS+Yv7RWruKHGpW9t:JaVZ2CVwfJmdmD+bSo
TLSH	T1E9D423A3F703C4724966CEDE32E9AB8B42F1543B455AECB17163DF866B064E3D021758
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Magika	rar
Reporter	cocaman
Tags:	MassLogger payment z

cocaman

Malicious email (T1566.001)
From: "Jessy Li<jessy@lantiantcca.com>" (likely spoofed)
Received: "from lantiantcca.com (unknown [158.94.208.200]) "
Date: "10 Oct 2025 02:38:21 -0700"
Subject: "PAYMENT TT COPY AGAINST SHIPMENT"
Attachment: "PAYMENT TT COPY.PDF.z"

Intelligence

File Origin

# of uploads :

# of downloads :

114

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	PAYMENT TT COPY.exe
File size:	685'568 bytes
SHA256 hash:	30d7b8019fbd65ff8e25ba109b663a6440f3f407a5e01a4bcddf7e7bef33eac4
MD5 hash:	dfac9045c13cd007bbadc487a4305092
MIME type:	application/x-dosexec
Signature	MassLogger

Vendor Threat Intelligence

Verdict:

Malicious

Score:

94.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68e8d461f2ca2f143e40f7d7

Tags:

shell spawn sage

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

base64 bitmap lolbin masquerade msbuild obfuscated packed packed reconnaissance regsvcs rezer0 roboski schtasks stego telegram vbc vbnet

Link:

https://www.filescan.io/uploads/68e8d45b4f3013c55e495e52/reports/53aebc32-a97c-401b-a1f4-8321f9eba2c5/overview

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/0d38a21bfbe0279058f17dd10bafe3db801697f6528a67f79cb3f3ca483532ac

Verdict:

Malicious

File Type:

rar

First seen:

2025-10-10T06:01:00Z UTC

Last seen:

2025-10-12T05:25:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/0d38a21bfbe0279058f17dd10bafe3db801697f6528a67f79cb3f3ca483532ac/results?tab=lookup

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/0d38a21bfbe0279058f17dd10bafe3db801697f6528a67f79cb3f3ca483532ac/

Verdict:

Malicious

Threat:

Family.SNAKE

Link:

https://tip.neiki.dev/file/0d38a21bfbe0279058f17dd10bafe3db801697f6528a67f79cb3f3ca483532ac

Threat name:

ByteCode-MSIL.Spyware.Negasteal

Status:

Malicious

First seen:

2025-10-10 09:38:51 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

18 of 31 (58.06%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=bu4keg734atzawhrpxiqxl7d3oabnf7wkkfgp544wpz4usbvgkwa._file

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/0d38a21bfbe0279058f17dd10bafe3db801697f6528a67f79cb3f3ca483532ac

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)