MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 25f9ea7ccf9d115c0eaf43cd2371c353cb02dd13f5847a8933a6316d4f59f268. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 6


Intelligence 6 IOCs YARA 20 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 25f9ea7ccf9d115c0eaf43cd2371c353cb02dd13f5847a8933a6316d4f59f268
SHA3-384 hash: 0a58cfa3b6d15c0cb3e8c651103f6737550d76f282861447b70507e75979808c90b7652cb5b911ac4722861ffa3f3bad
SHA1 hash: d866d33e072545ae217b624da706280bd0bf14ec
MD5 hash: 23aaef6851406948fe20bba1ab62d687
humanhash: golf-victor-maryland-finch
File name:TAX_INVOICE_446.r09
Download: download sample
Signature MassLogger
Create hunting rule
File size:478'586 bytes
First seen:2025-04-11 06:40:23 UTC
Last seen:Never
File type: r09
MIME type:application/x-rar
ssdeep 12288:zvq6DFngFaANXeLXAD/uBSjvIVBZEd01tmYSqcm4YjSCthw:zyOFgFaANCQuBSMadct91ez
TLSH T128A4234A055E374CE355AF73F721305AE56BEB0A72D1C8C5242E58B9FA01C8B8EC93E1
TrID 61.5% (.RAR) RAR compressed archive (v5.0) (8000/1)
38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Magika rar
Reporter cocaman
Tags:INVOICE MassLogger r09


Avatar
cocaman
Malicious email (T1566.001)
From: "manish.goplani@adityabirla.com" (likely spoofed)
Received: "from [141.98.10.71] (unknown [141.98.10.71]) "
Date: "10 Apr 2025 17:38:01 +0200"
Subject: "RE: TAX_INVOICE_446"
Attachment: "TAX_INVOICE_446.r09"

Intelligence

File Origin
# of uploads :
1
# of downloads :
96
Origin country :
CH CH
File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:TAX_INVOICE_446.exe
File size:551'424 bytes
SHA256 hash: e6481c323180a497b6bf9461adc33c9aedd2320b1700ea8c309565253585c0a1
MD5 hash: 356e2d3a12a2d39e79ac41d8d4d8cec4
MIME type:application/x-dosexec
Signature MassLogger
Vendor Threat Intelligence
Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=67f8c0e6d6e7c3effacfbab4
Tags:
virus krypt msil
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/25f9ea7ccf9d115c0eaf43cd2371c353cb02dd13f5847a8933a6316d4f59f268
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/25f9ea7ccf9d115c0eaf43cd2371c353cb02dd13f5847a8933a6316d4f59f268/
Threat name:
Win32.Trojan.Leonem
Create hunting rule
Status:
Malicious
First seen:
2025-04-10 17:15:03 UTC
File Type:
Binary (Archive)
Extracted files:
9
AV detection:
17 of 24 (70.83%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ex46u7gptuivydvpipgsg4odkpfqfxit6wchvcjtuyyw2t2z6jua._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/25f9ea7ccf9d115c0eaf43cd2371c353cb02dd13f5847a8933a6316d4f59f268

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AgentTesla_DIFF_Common_Strings_01
Create hunting rule
Author:schmidtsz
Description:Identify partial Agent Tesla strings
Rule name:crime_snake_keylogger
Create hunting rule
Author:Rony (r0ny_123)
Description:Detects Snake keylogger payload
Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_TelegramChatBot
Create hunting rule
Author:ditekSHen
Description:Detects executables using Telegram Chat Bot
Rule name:MAL_Envrial_Jan18_1
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects Encrial credential stealer malware
Reference:https://twitter.com/malwrhunterteam/status/953313514629853184
Rule name:MAL_Envrial_Jan18_1_RID2D8C
Create hunting rule
Author:Florian Roth
Description:Detects Encrial credential stealer malware
Reference:https://twitter.com/malwrhunterteam/status/953313514629853184
Rule name:masslogger_gcch
Create hunting rule
Author:govcert_ch
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
Rule name:telegram_bot_api
Create hunting rule
Author:rectifyq
Description:Detects file containing Telegram Bot API
Rule name:win32_dotnet_form_obfuscate
Create hunting rule
Author:Reedus0
Description:Rule for detecting .NET form obfuscate malware
Rule name:Windows_Trojan_SnakeKeylogger_af3faa65
Create hunting rule
Author:Elastic Security
Rule name:win_404keylogger_g1
Create hunting rule
Author:Rony (@r0ny_123)
Rule name:win_masslogger_w0
Create hunting rule
Author:govcert_ch

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

r09 25f9ea7ccf9d115c0eaf43cd2371c353cb02dd13f5847a8933a6316d4f59f268

(this sample)

MassLogger

Executable exe e6481c323180a497b6bf9461adc33c9aedd2320b1700ea8c309565253585c0a1

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e6481c323180a497b6bf9461adc33c9aedd2320b1700ea8c309565253585c0a1
  
Dropping
MassLogger
  
Dropping
MD5 356e2d3a12a2d39e79ac41d8d4d8cec4

Comments