MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1a98a78c6e63e52bd77d0a49c4738646e60c86e077174e523383509d2701f0e6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

MassLogger

Vendor detections: 15

Intelligence 15 IOCs YARA 8 File information Comments

SHA256 hash:	1a98a78c6e63e52bd77d0a49c4738646e60c86e077174e523383509d2701f0e6
SHA3-384 hash:	2aee291566f307b2f790d91fc8b640d4a1ae1ccbf7d14861d43b17089d46c0a33c726744cd101e36b85b618b02194123
SHA1 hash:	562e940a2acd0533a15b26daf69f6903a167bfda
MD5 hash:	78d6162f9f6ebf4296f105bfd32ca208
humanhash:	jig-north-virginia-fourteen
File name:	1a98a78c6e63e52bd77d0a49c4738646e60c86e077174e523383509d2701f0e6
Download:	download sample
Signature	MassLogger Create hunting rule
File size:	590'344 bytes
First seen:	2025-04-08 08:29:42 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'602 x Formbook, 12'241 x SnakeKeylogger)
ssdeep	12288:IO2iNczJ+Wnqn++1+GTCqBwPNPkTiJRsMyU9GkR:51qzMb+GTcNsTWR5y6d
Threatray	4'088 similar samples on MalwareBazaar
TLSH	T1AEC401EC5618E603CA9217B10AB1F674537A2EDDE900D2265FED6EEFB972F104D04293
TrID	71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10522/11/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4504/4/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika	pebin
Reporter	adrian__luca
Tags:	exe MassLogger

Intelligence

File Origin

# of uploads :

# of downloads :

318

Origin country :

Vendor Threat Intelligence

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67f4e03ee011fe619fad2319

Tags:

masslogger virus spawn msil

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Creating a window

Сreating synchronization primitives

Creating a process with a hidden window

Unauthorized injection to a recently created process

Restart of the analyzed sample

Creating a file

DNS request

Connection attempt

Sending an HTTP GET request

Sending a custom TCP request

Reading critical registry keys

Adding an exclusion to Microsoft Defender

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

expired-cert infostealer invalid-signature obfuscated packed packed packer_detected signed vbnet

Link:

https://www.filescan.io/uploads/67f4de9f40adfb5162bbfed4/reports/2df51ef8-b3d8-4d20-ba0e-f79af3a491d1/overview

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/1a98a78c6e63e52bd77d0a49c4738646e60c86e077174e523383509d2701f0e6

Malware family:

Snake Keylogger

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/60a8cdb7-69f5-4ddc-a902-f24990b82050

Result

Threat name:

MSIL Logger, MassLogger RAT

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1659641

Signature

.NET source code contains potential unpacker

.NET source code references suspicious native API functions

Adds a directory exclusion to Windows Defender

Contains functionality to log keystrokes (.Net Source)

Found malware configuration

Injects a PE file into a foreign processes

Joe Sandbox ML detected suspicious sample

Loading BitLocker PowerShell Module

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Yara detected AntiVM3

Yara detected MassLogger RAT

Yara detected MSIL Logger

Yara detected Telegram RAT

Behaviour

Behavior Graph:

Download SVG

Score:

99%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/1a98a78c6e63e52bd77d0a49c4738646e60c86e077174e523383509d2701f0e6

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/1a98a78c6e63e52bd77d0a49c4738646e60c86e077174e523383509d2701f0e6/

Threat name:

ByteCode-MSIL.Backdoor.njRAT

Status:

Malicious

First seen:

2025-03-26 13:46:09 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

24 of 36 (66.67%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=dkmkpddompssxv35bje4i44gi3tazbxao4lu4urtqnij2jyb6dta._file

Verdict:

malicious

Label(s):

unc_loader_037

novastealer

MassLogger

80edf30940ba58cb632cb8b5bbed7f57df1dbc9c682ddc744b9ed44af3583db8

MassLogger

91c51905a2db1c29aa562d975beac52d8895342b0ccecb16aeb5d40daa97d2b6

MassLogger

efa962fc10045f83da36ea363c43aba7a8d5ff3ec0e3aaa4c6480c2578b8c4fa

MassLogger

+ 4'078 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

8/10

Tags:

collection discovery execution spyware stealer

Link:

https://tria.ge/reports/250408-kef9hasjz9/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Checks computer location settings

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Command and Scripting Interpreter: PowerShell

Verdict:

Malicious

Tags:

404keylogger

YARA:

n/a

Link:

https://app.threat.zone/submission/efd4739c-00da-4965-90e9-6837b61cf76a

Unpacked files

SH256 hash:

1a98a78c6e63e52bd77d0a49c4738646e60c86e077174e523383509d2701f0e6

MD5 hash:

78d6162f9f6ebf4296f105bfd32ca208

SHA1 hash:

562e940a2acd0533a15b26daf69f6903a167bfda

Link:

https://www.unpac.me/results/3cfc0265-51a1-47da-a203-bd676f11b579/

SH256 hash:

e71521007e64e4011f80f4fb6f8fa07b05be52e8088ed18c0c19881a6391fb45

MD5 hash:

cb717a71e67908fb20e04b13ebec3aec

SHA1 hash:

2f2e5d402c19c4cbd98fdace3b9049fc1c42d565

Detections:

win_404keylogger_g1

win_masslogger_w0

MAL_Envrial_Jan18_1

INDICATOR_SUSPICIOUS_Binary_References_Browsers

INDICATOR_SUSPICIOUS_EXE_TelegramChatBot

Link:

https://www.unpac.me/results/3cfc0265-51a1-47da-a203-bd676f11b579/

Parent samples :

7fc21521b3e61d0555c0c1adb947d9724c8ca61dc9caeef85a110ec46d3b2d5d
43d909c8afd4fe8010ca22bd90a2f65fd6e4275c36d103b91d0016f0c2988883
b8f79e1b5aecb07c83251141f0b128274c49697ebea217c83787abdf07fe00f2
e71521007e64e4011f80f4fb6f8fa07b05be52e8088ed18c0c19881a6391fb45
4be8e656872c1d27eeaec3bd38a9fd51648893ca4f8b79741b40e395ef91615e
35ebe17f33803f292a173b8652fdd9c69be8e6b89bc9897776e41c3a721b4211
efa962fc10045f83da36ea363c43aba7a8d5ff3ec0e3aaa4c6480c2578b8c4fa
1a98a78c6e63e52bd77d0a49c4738646e60c86e077174e523383509d2701f0e6
020b4368059e1fd314ad7299d62c0c1373fe19d6f8fae574d804c7f20c914de5
4dce97ef955a132177e7043fc0d11e35c3e1d03f833b3b30951d7b2ce6db735e

SH256 hash:

565225a8561134b4966c139430b4d6945eedd45444d8435a48c6e7f41f7f7e30

MD5 hash:

3aebca61c665584c799acf55900cb26e

SHA1 hash:

3717a4f60d2822dfd8effda5490c93e7ccb38ebc

Link:

https://www.unpac.me/results/3cfc0265-51a1-47da-a203-bd676f11b579/

SH256 hash:

718b166e9328bb6e117d17c05aab67284a8b84243cccd626a3836aa0dca3d22c

MD5 hash:

e038182fb3f6fb25871f568b3aba965c

SHA1 hash:

b44c582834a1acc75ef15315ab81b165e91359ae

Detections:

SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24

SUSP_OBF_NET_Reactor_Indicators_Jan24

Link:

https://www.unpac.me/results/3cfc0265-51a1-47da-a203-bd676f11b579/

Malware family:

PrivateLogger

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/1a98a78c6e63/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/1a98a78c6e63e52bd77d0a49c4738646e60c86e077174e523383509d2701f0e6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	AgentTesla_DIFF_Common_Strings_01 Create hunting rule
Author:	schmidtsz
Description:	Identify partial Agent Tesla strings

Rule name:	INDICATOR_KB_CERT_7c1118cbbadc95da3752c46e47a27438 Create hunting rule
Author:	ditekSHen
Description:	Detects executables signed with stolen, revoked or invalid certificates

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

No further information available

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample