🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 26f4fd7217794560c9cf8dae6f9230e35b13f0471bd4d03f3cc372e6a2fd2f40. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 14


Intelligence 14 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 26f4fd7217794560c9cf8dae6f9230e35b13f0471bd4d03f3cc372e6a2fd2f40
SHA3-384 hash: f54a9d661af913bf985ded70df3d313ddcd10f617818c0569623c7aa538377a3229539f02ba99b678eb3f058542406b4
SHA1 hash: c2de661e090d8c8d3ae10ab5d9a91f58eee36ce8
MD5 hash: 47ed7361739846e6a1881554030fb413
humanhash: black-asparagus-three-hawaii
File name:S0007961125036607.exe
Download: download sample
Signature MassLogger
Create hunting rule
File size:915'456 bytes
First seen:2026-09-24 14:56:39 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'245 x AgentTesla, 20'500 x Formbook, 12'374 x SnakeKeylogger)
ssdeep 24576:87MAbNJYZQQ4PfN+jdwkSK6+iibnndMq:beNJYZQV48Rf+nd
TLSH T1EC15F11423A8E646DCEA17F40AB5E7390BB53D4EE920D30E8EE5BDEB3422F565844743
TrID 72.4% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
6.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.4% (.EXE) Win64 Executable (generic) (6522/11/2)
4.4% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.EXE) Win16/32 Executable Delphi generic (2072/23)
Magika pebin
Reporter James_inthe_box
Tags:exe MassLogger

Intelligence

File Origin
# of uploads :
1
# of downloads :
168
Origin country :
US US
Vendor Threat Intelligence
Malware configuration found for:
RoboSki
Details
Link:
https://research.acce.ciphertechsolutions.com/results/6f0d1eb7-9fd3-46cc-b7b0-f5a23b8ad740/
Malware family:
n/a
ID:
1
File name:
26f4fd7217794560c9cf8dae6f9230e35b13f0471bd4d03f3cc372e6a2fd2f40.zip
Verdict:
No threats detected
Analysis date:
2026-09-24 16:15:09 UTC
Tags:
arch-exec
Link:
https://app.any.run/tasks/14344a93-9779-4b4a-a3bc-d5bd7e9c8874

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/88818/
Detection(s):
SecuriteInfo.com.Trojan.Inject7.3741.24556.2706.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Сreating synchronization primitives
Creating a process with a hidden window
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Launching a process
Creating a file
DNS request
Connection attempt
Sending an HTTP GET request
Sending a custom TCP request
Reading critical registry keys
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Stealing user critical data
Adding an exclusion to Microsoft Defender
Unauthorized injection to a system process
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
packed vbnet
Link:
https://www.filescan.io/uploads/6ab53a481ea547f5ed33ee22/reports/99c7531b-0336-4b37-bc5a-be64323b62ee/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/26f4fd7217794560c9cf8dae6f9230e35b13f0471bd4d03f3cc372e6a2fd2f40
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-09-24T06:07:00Z UTC
Last seen:
2026-09-26T06:22:00Z UTC
Hits:
~1000
Link:
https://opentip.kaspersky.com/26f4fd7217794560c9cf8dae6f9230e35b13f0471bd4d03f3cc372e6a2fd2f40/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/097794ff-9c80-4557-bd60-4c1e67d55079
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/26f4fd7217794560c9cf8dae6f9230e35b13f0471bd4d03f3cc372e6a2fd2f40
Verdict:
inconclusive
YARA:
10 match(es)
Tags:
.Net Executable Managed .NET PE (Portable Executable) PE File Layout SOS: 0.40 Win 32 Exe x86
Link:
https://app.malva.re/file/47ed7361739846e6a1881554030fb413
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/26f4fd7217794560c9cf8dae6f9230e35b13f0471bd4d03f3cc372e6a2fd2f40/
Threat name:
Win32.Trojan.Masslogger
Create hunting rule
Status:
Malicious
First seen:
2026-09-24 09:01:00 UTC
File Type:
PE (.Net Exe)
Extracted files:
7
AV detection:
27 of 38 (71.05%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=e32p24qxpfcwbsoprwxg7erq4nnrh4chdpknapz4ynzonix5f5aa._file
Verdict:
malicious
Label(s):
NovaStealer
Create hunting rule
Link:
https://reports.threatray.com/f364774f-4bca-49a3-ad18-1dc62193f6f6
Result
Malware family:
masslogger
Create hunting rule
Score:
  10/10
Tags:
family:masslogger collection discovery execution persistence spyware stealer
Link:
https://tria.ge/reports/260924-sbns6svz4j/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
System Location Discovery: System Language Discovery
SmartAssembly .NET packer
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Adds Run key to start application
Looks up external IP address via web service
Checks computer location settings
Executes dropped EXE
Command and Scripting Interpreter: PowerShell
Family: MassLogger
Unpacked files
SH256 hash:
26f4fd7217794560c9cf8dae6f9230e35b13f0471bd4d03f3cc372e6a2fd2f40
MD5 hash:
47ed7361739846e6a1881554030fb413
SHA1 hash:
c2de661e090d8c8d3ae10ab5d9a91f58eee36ce8
Link:
https://www.unpac.me/results/070f9e7f-3bf3-4bd9-a0fa-7c338efaff67/
SH256 hash:
4e81887a0cdc67b20439799d19a4eca238e0d279287d73df9d32ba70567f0202
MD5 hash:
4c2e2a907fceaa7c3c476d90e32d9e68
SHA1 hash:
51a17d4e517578e860d7e9325037ab85f0b698db
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/070f9e7f-3bf3-4bd9-a0fa-7c338efaff67/
SH256 hash:
2aa55de579c0d6cb2cab5c4359bec4a98409b004e128c3faedf6fe07d962e8c2
MD5 hash:
33534078486a24bb500ddb73d55e5d77
SHA1 hash:
709e44b02a4f828709f962cd60e47636bc96c32c
Detections:
triage_snakekeylogger_infostealer
Create hunting rule
win_404keylogger_g1
Create hunting rule
win_masslogger_w0
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_TelegramChatBot
Create hunting rule
MAL_Envrial_Jan18_1
Create hunting rule
Link:
https://www.unpac.me/results/070f9e7f-3bf3-4bd9-a0fa-7c338efaff67/
Parent samples :
f840ab670cff8c5a85b52a8133ad961aa8863abca0bcb1f12de1012e48d38dfb
26f4fd7217794560c9cf8dae6f9230e35b13f0471bd4d03f3cc372e6a2fd2f40
SH256 hash:
e8204fc3f06561d5c8fc8554ceca48fecb1fb185979f1d959f82156f44806060
MD5 hash:
9604cb77539049822456da0664bcb734
SHA1 hash:
bc1b7782c2bc6fb4497f6a40153edeb9a94c1b66
Detections:
INDICATOR_EXE_Packed_SmartAssembly
Create hunting rule
Link:
https://www.unpac.me/results/070f9e7f-3bf3-4bd9-a0fa-7c338efaff67/
Parent samples :
f9978c6e34be9228a6638b37653c4e390002d5984192f71fdbc9e3fb1b0e1124
61539d1e98768dcb4843cb39e0c40625c015d8a2fce217beffe369349b6b8f1d
55ea55d00c35618218783fa8b647a760a7876eaa9fad2d30dddee8600b15895a
b13566d9fe407cc22c901a4a624a326999c74ec3e63ee1b2772741e460333c77
26f4fd7217794560c9cf8dae6f9230e35b13f0471bd4d03f3cc372e6a2fd2f40
Malware family:
MassLogger
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/26f4fd721779/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/26f4fd7217794560c9cf8dae6f9230e35b13f0471bd4d03f3cc372e6a2fd2f40

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:WIN_Sample_Unique_69354b41
Create hunting rule
Author:Marjoriefort
Description:Specimen unique (soumission Bazaar) - strings distinctifs propres au sample
Reference:69354b41e10daf03d3f3af881b32d5c0fec56b1cfe96629fd4c5263413a42854.exe

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/88818/

Comments