MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3317dad166e61c92ef0c9b030d6174fda8842a0dc33fdeadd2bfd86ffcd5a01c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 17


Intelligence 17 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3317dad166e61c92ef0c9b030d6174fda8842a0dc33fdeadd2bfd86ffcd5a01c
SHA3-384 hash: 5f184b1bf39340f47184b57cfeef689572fa439826af5749e0ac19c6c3c950169f485612b497ca4761753298cf2724dd
SHA1 hash: 705ed6c8fdf814849ddd4cde5ffd712dad1ec6ff
MD5 hash: ede4c6f87901cfa819cd0f5bc4e1fb20
humanhash: carolina-north-mars-freddie
File name:SecuriteInfo.com.Win32.MalwareX-gen.2224.16964
Download: download sample
Signature MassLogger
Create hunting rule
File size:551'944 bytes
First seen:2025-08-01 05:27:05 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'662 x AgentTesla, 19'477 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:KeNXP+unerGZx+LZYgfp5w2bKguRBqz1R1m/6hkR:KMXPfeiZxopaGTu3qn1m/L
Threatray 3'655 similar samples on MalwareBazaar
TLSH T105C4F064EE63E502F490537303A1E67673695DADA5C0C2B17AF8EECB7A9D7000F63252
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10522/11/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
dhash icon 4c36f2cca3dc949c (7 x SnakeKeylogger, 2 x MassLogger, 2 x a310Logger)
Reporter SecuriteInfoCom
Tags:exe MassLogger

Intelligence

File Origin
# of uploads :
1
# of downloads :
89
Origin country :
FR FR
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SecuriteInfo.com.Win32.MalwareX-gen.2224.16964
Verdict:
Malicious activity
Analysis date:
2025-08-01 05:27:59 UTC
Tags:
snake keylogger evasion stealer auto-sch-xml ims-api generic
Link:
https://app.any.run/tasks/573a4057-885a-40b2-b1c8-408169992692

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/18208/
Verdict:
Malicious
Score:
96.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=688c50410b4775fb21346aa1
Tags:
micro krypt spam msil
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Creating a process with a hidden window
Creating a file in the %temp% directory
Launching a process
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Сreating synchronization primitives
DNS request
Connection attempt
Sending an HTTP GET request
Adding an exclusion to Microsoft Defender
Enabling autorun by creating a file
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
invalid-signature obfuscated packed packed packer_detected signed
Link:
https://www.filescan.io/uploads/688c503b3228e5a4037f029c/reports/e958a7e4-7ebd-4033-b40f-dc9d32965127/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/3317dad166e61c92ef0c9b030d6174fda8842a0dc33fdeadd2bfd86ffcd5a01c
Malware family:
Snake Keylogger
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/228be486-b3cc-49b1-939c-f6e66ebae7ed
Score:
97%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/3317dad166e61c92ef0c9b030d6174fda8842a0dc33fdeadd2bfd86ffcd5a01c
Verdict:
inconclusive
YARA:
10 match(es)
Tags:
.Net Executable PDB Path PE (Portable Executable) SOS: 0.34 Win 32 Exe x86
Link:
https://app.malva.re/file/ede4c6f87901cfa819cd0f5bc4e1fb20
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3317dad166e61c92ef0c9b030d6174fda8842a0dc33fdeadd2bfd86ffcd5a01c/
Verdict:
Malicious
Threat:
Family.SNAKE
Link:
https://tip.neiki.dev/file/3317dad166e61c92ef0c9b030d6174fda8842a0dc33fdeadd2bfd86ffcd5a01c
Threat name:
Win32.Spyware.Negasteal
Create hunting rule
Status:
Malicious
First seen:
2025-08-01 04:31:58 UTC
File Type:
PE (.Net Exe)
Extracted files:
10
AV detection:
22 of 38 (57.89%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=gml5vulg4yojf3ymtmbq2ylu7wuiikqnym755losx7mg77gvuaoa._file
Verdict:
malicious
Label(s):
unc_loader_037
Create hunting rule
novastealer
Create hunting rule
Similar samples:
034de66fa09061895f96da260b2eeb73774d916830540d59a310ea3c5f64197a
MassLogger
137ad8a9d3784ef9ae6429b6fcc3b1e7855a323c848e1d7532cae07c8b727179
MassLogger
371e5213895306bc58052925b92da7af2770b12683525c7361934b6477399f54
MassLogger
error
MassLogger
ff319430f00da8eebd3b92f0d494c1dd9bee7f9ef3a8101dda2ce14968b9811a
MassLogger
+ 3'645 additional samples on MalwareBazaar
Result
Malware family:
masslogger
Create hunting rule
Score:
  10/10
Tags:
family:masslogger collection discovery execution persistence spyware stealer
Link:
https://tria.ge/reports/250801-f5l58acm8s/
Behaviour
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Checks computer location settings
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Command and Scripting Interpreter: PowerShell
MassLogger
Masslogger family
Malware Config
C2 Extraction:
https://api.telegram.org/bot8249574412:AAEYI1aKTMsQBYXH4o8C5XnXqiv65jV2kC8/sendMessage?chat_id=6488172735
Verdict:
Malicious
Tags:
404Keylogger
YARA:
n/a
Link:
https://app.threat.zone/submission/7bb511e5-403a-4443-8617-7c11156cbf6e
Unpacked files
SH256 hash:
3317dad166e61c92ef0c9b030d6174fda8842a0dc33fdeadd2bfd86ffcd5a01c
MD5 hash:
ede4c6f87901cfa819cd0f5bc4e1fb20
SHA1 hash:
705ed6c8fdf814849ddd4cde5ffd712dad1ec6ff
Link:
https://www.unpac.me/results/3877fffa-86f7-430c-98ae-8c67b6ba8af8/
SH256 hash:
997767038a47666f2f52cbcf7755357e7ea9015692d7bebea415f8b26838a1b4
MD5 hash:
15067338f97bc24cc2ac550e51a9dcb5
SHA1 hash:
44882ee8f9ff92edf6a75f61850e9036d857464b
Link:
https://www.unpac.me/results/3877fffa-86f7-430c-98ae-8c67b6ba8af8/
SH256 hash:
2c03c4cd1ad090f5251c118be6f94d15d47768f715cfe5f9afffd23e5b4f0d9d
MD5 hash:
4270667ecfe70a2323f0fd963d0c92e0
SHA1 hash:
64e8039a6de5424a911f7d9c0c2a1f2ecdab6f4e
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/3877fffa-86f7-430c-98ae-8c67b6ba8af8/
SH256 hash:
08ce10c17846656faa7ea428c7d962e8d58a288606e355a1c9a6d74d86c537c6
MD5 hash:
c86241d18c00d916f3847b3cb69b7a88
SHA1 hash:
c0a80776c8aaea90af281101665cf79d18f2116f
Detections:
win_404keylogger_g1
Create hunting rule
win_masslogger_w0
Create hunting rule
MAL_Envrial_Jan18_1
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_TelegramChatBot
Create hunting rule
Link:
https://www.unpac.me/results/3877fffa-86f7-430c-98ae-8c67b6ba8af8/
Parent samples :
034de66fa09061895f96da260b2eeb73774d916830540d59a310ea3c5f64197a
3317dad166e61c92ef0c9b030d6174fda8842a0dc33fdeadd2bfd86ffcd5a01c
6e1b5766415cd5d8e7f92d995828f0bca174fc5141af7e59e73f92e057df0626
7f13aacf27f72555c75715896013a1cad6968603e8db181f775675786abbe45d
3aab9854341050b969aa81bb5ba790767b3c50a4053368e90e70f9c68260473c
1dfeb104751544afbe70f792ef95535246eba683cdf47f21cb62038f8b5d86d6
0dae2a3a734163ec368a271822356004e53f8556ad654956dfd7570a49ba2b20
bd3da5f97d8b35c43ec96dedb259484caf1de63a4c1a2091963cb60444ea2c36
51b036522abdbc3cd223aaa8dde959ae3f02b80bd1955f61442fcc8e15696a88
76cff505d993baaecd718a3b0de1814da0aef73ce932d95bacbc6d842db38807
d271fd8cdb9d18bb653545cee69547ca2c6114bf2e810b04d81734b323cacfe6
aead3e1cb0db44b9594135a3a395c5d8e510bce1a0f938146df16a67d75a8e68
Malware family:
MassLogger
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/3317dad166e6/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/3317dad166e61c92ef0c9b030d6174fda8842a0dc33fdeadd2bfd86ffcd5a01c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_KB_CERT_7c1118cbbadc95da3752c46e47a27438
Create hunting rule
Author:ditekSHen
Description:Detects executables signed with stolen, revoked or invalid certificates
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/18208/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (GUARD_CF)high

Comments