🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 416c02fdc82b8d6456f1e08a796a2347d1ac04ac35dfa67c898e4802678ff60c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 15


Intelligence 15 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 416c02fdc82b8d6456f1e08a796a2347d1ac04ac35dfa67c898e4802678ff60c
SHA3-384 hash: 004390d5c9728fab2aef7818d7811ab5f1e5ab1bd0aa656043840681e4a08884d585faee6d54573819a527b3337fb4f9
SHA1 hash: 2b083c19214768fe1a9c3d7da95a33842cbd33ef
MD5 hash: de09bb3146e6e646249a10ba36170b94
humanhash: table-robert-uncle-hotel
File name:416c02fdc82b8d6456f1e08a796a2347d1ac04ac35dfa67c898e4802678ff60c
Download: download sample
Signature MassLogger
Create hunting rule
File size:824'320 bytes
First seen:2026-09-04 20:19:47 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'272 x AgentTesla, 20'618 x Formbook, 12'394 x SnakeKeylogger)
ssdeep 24576:zP4oYGa5JpKBhPJIkh56Yr9nqtOdE7y8yWKK4G:DfojpKzNMYstOdE7y8yWD/
TLSH T1CE05229877A5D612E9761FF81822F13013B83DADA632E71A5FED2CDB3A137201824717
TrID 73.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
6.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.6% (.EXE) Win64 Executable (generic) (6522/11/2)
4.5% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter adrian__luca
Tags:exe MassLogger

Intelligence

File Origin
# of uploads :
1
# of downloads :
74
Origin country :
HU HU
Vendor Threat Intelligence
Malware configuration found for:
RoboSki
Details
Link:
https://research.acce.ciphertechsolutions.com/results/97d8c8e3-6bb5-4a44-8905-d0aa495faaef/
Malware family:
n/a
ID:
1
File name:
exe
Verdict:
Malicious activity
Analysis date:
2026-09-04 22:35:03 UTC
Tags:
auto-reg ip-check evasion stealer smtp
Link:
https://app.any.run/tasks/ff3dff36-923b-4468-a497-5a265a61f467

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/83980/
Detection(s):
Win.Packed.Malwarex-10060435-0
Create hunting rule

Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ac8a87a4de271defd2ced4e
Tags:
shell virus micro spam
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Сreating synchronization primitives
Creating a process with a hidden window
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Launching a process
Adding an exclusion to Microsoft Defender
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
base64 packed
Link:
https://www.filescan.io/uploads/6a9b2801a99ba49ea8e5d5f0/reports/95eb18e4-4f41-4252-90d9-140ebb9ec200/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/416c02fdc82b8d6456f1e08a796a2347d1ac04ac35dfa67c898e4802678ff60c
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-07-29T06:50:00Z UTC
Last seen:
2026-09-05T21:30:00Z UTC
Hits:
~1000
Link:
https://opentip.kaspersky.com/416c02fdc82b8d6456f1e08a796a2347d1ac04ac35dfa67c898e4802678ff60c/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/ce486738-fd46-4605-a114-c139f284e58e
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/416c02fdc82b8d6456f1e08a796a2347d1ac04ac35dfa67c898e4802678ff60c
Verdict:
inconclusive
YARA:
10 match(es)
Tags:
.Net Executable Managed .NET PE (Portable Executable) PE File Layout SOS: 0.42 Win 32 Exe x86
Link:
https://app.malva.re/file/de09bb3146e6e646249a10ba36170b94
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/416c02fdc82b8d6456f1e08a796a2347d1ac04ac35dfa67c898e4802678ff60c/
Threat name:
Win32.Spyware.Negasteal
Create hunting rule
Status:
Malicious
First seen:
2026-07-29 19:30:26 UTC
File Type:
PE (.Net Exe)
Extracted files:
4
AV detection:
28 of 38 (73.68%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ifwaf7oifogwivxr4cfhs2rdi7i2ybfmgxp2m7ejrzeaez4p6yga._file
Verdict:
malicious
Label(s):
NovaStealer
Create hunting rule
Link:
https://reports.threatray.com/151cf64b-5370-445b-84a3-77cfa26b0eaa
Result
Malware family:
masslogger
Create hunting rule
Score:
  10/10
Tags:
family:masslogger collection discovery execution persistence spyware stealer
Link:
https://tria.ge/reports/260904-y4na1azcmb/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Adds Run key to start application
Looks up external IP address via web service
Checks computer location settings
Executes dropped EXE
Command and Scripting Interpreter: PowerShell
Family: MassLogger
Unpacked files
SH256 hash:
416c02fdc82b8d6456f1e08a796a2347d1ac04ac35dfa67c898e4802678ff60c
MD5 hash:
de09bb3146e6e646249a10ba36170b94
SHA1 hash:
2b083c19214768fe1a9c3d7da95a33842cbd33ef
Link:
https://www.unpac.me/results/27fb63dd-16d5-4c5d-8d5f-82430b240983/
SH256 hash:
eaf25dd110bc91ee5000644e517678981138ff9508e011600ace6351cdc83241
MD5 hash:
36eab044ee9af604f7e28e3a7ee0f525
SHA1 hash:
5bc0592f374a05b9e2233d194902b88791555cc6
Detections:
triage_snakekeylogger_infostealer
Create hunting rule
win_404keylogger_g1
Create hunting rule
win_masslogger_w0
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_TelegramChatBot
Create hunting rule
MAL_Envrial_Jan18_1
Create hunting rule
Link:
https://www.unpac.me/results/27fb63dd-16d5-4c5d-8d5f-82430b240983/
Parent samples :
d9e876c0ef78f0d6087d0c41c8d47ebe9fc8137055c9d74bbb7c1fd7fb8e1fdf
01ad626abefeb19a1fd65ec27599b6cdc0d025dc42261317e77480860ffa7a09
4a1b87430fe4ad7a1e9a35d99f7c612e7f2d8dce339edd172753aee1632653cc
416c02fdc82b8d6456f1e08a796a2347d1ac04ac35dfa67c898e4802678ff60c
40ef805fbbf333e9a2c47bf8ca3832dd854829da0a31469ec5fd271348b6fab4
687587baff7f25ded9f03274277f12b6d6a347af2238c3b32defc2736bc7023b
301a9e3b24f14798ed32be5de3dd802b4c13edc182bc1e29f80a40a1dcc2425e
519de0a4ed8131067f6364e3ae9f010d962f897e50fbdc7479f1325947b68525
1ccf47d19e5181c626bf6ad2bad6e95051a3281e9234b3202906bbd8aadd79a4
9db47d46c9411cef28cb767455f523c0ed8bfdb9cb6a087b665fdab87d7741eb
9cbc97f1e626ea10a3f415d31ba5a6e499012c57c487c23c5b3c7603806bd687
ad83577e425dfb5496897d25e3e4e7de8d7e100f4b0eacf1266eb9f12898fac8
SH256 hash:
99a747f8a19b7ec44413573af831cf3d4b19f37ce9b341f9f9e925696c8ec17e
MD5 hash:
5a57ca873f1c47beeb57030d3dc72b4e
SHA1 hash:
86f1221dc1a602bbc6f273989eb339bd74fa936c
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/27fb63dd-16d5-4c5d-8d5f-82430b240983/
SH256 hash:
47a856ff7d9bf14949f9a1deed4ba4ec9495a9ef95ee41ba6d78f630561d166c
MD5 hash:
332b4cd85d1b878f5c5bf709b5984644
SHA1 hash:
ddba69ce01e7ea28029d271d4dd2f75bc3bf454f
Link:
https://www.unpac.me/results/27fb63dd-16d5-4c5d-8d5f-82430b240983/
Malware family:
MassLogger
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/416c02fdc82b/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/83980/

Comments