MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4bce84d45cb1c1a63ef738924c27a5c0904961307dbe305cd470c92208d283ff. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 16


Intelligence 16 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4bce84d45cb1c1a63ef738924c27a5c0904961307dbe305cd470c92208d283ff
SHA3-384 hash: a09212e3ebd4a04286ea6c31300b42c4f95366f0085a89c375f6fc049d0fa3459b3455912696f0f79fac1785bd5f1254
SHA1 hash: d1537fcbcc3fbadd02da2ad6ceb35b7a88d66e15
MD5 hash: cea527b19773d2df031c4bdb5da1f0ec
humanhash: hotel-july-coffee-utah
File name:4bce84d45cb1c1a63ef738924c27a5c0904961307dbe305cd470c92208d283ff
Download: download sample
Signature MassLogger
Create hunting rule
File size:962'048 bytes
First seen:2025-08-12 14:55:14 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'608 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:Eufu8wTq6uvf81IVzNLOy0c361eKRUqDG7A6A0dfz534VVVek:EuJd6KfbVzNC5R1eQqRAW7534VVVe
Threatray 3'704 similar samples on MalwareBazaar
TLSH T18B1506E291A508A5D4B35DB08812E8373256AC9AD82385188ED7FF5BF5F3ED30C23957
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10522/11/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
dhash icon 8e8f0f0f964d4d2c (4 x Formbook, 3 x AgentTesla, 3 x SnakeKeylogger)
Reporter adrian__luca
Tags:exe MassLogger

Intelligence

File Origin
# of uploads :
1
# of downloads :
86
Origin country :
HU HU
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
_4bce84d45cb1c1a63ef738924c27a5c0904961307dbe305cd470c92208d283ff.exe
Verdict:
Malicious activity
Analysis date:
2025-08-12 20:12:33 UTC
Tags:
evasion snake keylogger stealer ims-api generic
Link:
https://app.any.run/tasks/a3ff1bea-052c-40ab-b7f1-4ba5028f06a2

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/20869/
Verdict:
Malicious
Score:
96.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=689b5a32fca70bd90e8f1e93
Tags:
virus micro
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Сreating synchronization primitives
Searching for synchronization primitives
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
DNS request
Connection attempt
Sending an HTTP GET request
Sending a custom TCP request
Reading critical registry keys
Stealing user critical data
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/4bce84d45cb1c1a63ef738924c27a5c0904961307dbe305cd470c92208d283ff
Malware family:
Snake Keylogger
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/d3caa30c-763a-4a50-bb66-657bebbd8d26
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/4bce84d45cb1c1a63ef738924c27a5c0904961307dbe305cd470c92208d283ff
Gathering data
Gathering data
Verdict:
Malicious
Threat:
Family.SNAKE
Link:
https://tip.neiki.dev/file/4bce84d45cb1c1a63ef738924c27a5c0904961307dbe305cd470c92208d283ff
Threat name:
ByteCode-MSIL.Trojan.DarkCloud
Create hunting rule
Status:
Malicious
First seen:
2025-07-30 10:51:40 UTC
File Type:
PE (.Net Exe)
Extracted files:
23
AV detection:
27 of 36 (75.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jphijvc4wha2mpxxhcjeyj5fyciesyjqpw7daxguodesecgsqp7q._file
Verdict:
malicious
Label(s):
novastealer
Create hunting rule
unc_loader_037
Create hunting rule
Similar samples:
0228c928cdc2312658629a75d65bb333014b28585f6b5614db51b86e7189a234
MassLogger
03260ed0ef22a3464f72a8e830d5762a789169557137f598c27cdf6de13d2dda
MassLogger
5579cd8909db7f38d563cbbec9f5ec092d0e08f6fdff35c234653f23169ddd3f
MassLogger
ceaa99440a1294e1a574941c6f1b01db99ad6d85d314264156989e893a64cd6e
MassLogger
+ 3'694 additional samples on MalwareBazaar
Result
Malware family:
masslogger
Create hunting rule
Score:
  10/10
Tags:
family:masslogger collection discovery spyware stealer
Link:
https://tria.ge/reports/250812-vhmkssspw8/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Reads user/profile data of local email clients
Reads user/profile data of web browsers
MassLogger
Masslogger family
Malware Config
C2 Extraction:
https://api.telegram.org/bot8102271568:AAFMLIpgRl9Y9-vMi-6yfKv0hWCLCK72Wzo/sendMessage?chat_id=7162179174
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/009e1cbe-520f-4737-a5d1-5fd6e49d82fb
Unpacked files
SH256 hash:
4bce84d45cb1c1a63ef738924c27a5c0904961307dbe305cd470c92208d283ff
MD5 hash:
cea527b19773d2df031c4bdb5da1f0ec
SHA1 hash:
d1537fcbcc3fbadd02da2ad6ceb35b7a88d66e15
Link:
https://www.unpac.me/results/509aebeb-abee-461d-88e1-83ae99d184c2/
SH256 hash:
278bcb3053256447c4039100b8c18a4170ba869dd7accdcde7ffffe7f6571315
MD5 hash:
11a316f1cd540617b55691c0159c956a
SHA1 hash:
676710df9591ef44a02185f0b07520413dd0f511
Link:
https://www.unpac.me/results/509aebeb-abee-461d-88e1-83ae99d184c2/
SH256 hash:
b626b022d19120f29057d24a24284f5e0db0966c695fcddd48c559e007344d05
MD5 hash:
75badf051f3591d563ffcdb6dd396094
SHA1 hash:
9529a1ce091b7c591b9acb42a5569dfda85f09fd
Detections:
win_404keylogger_g1
Create hunting rule
win_masslogger_w0
Create hunting rule
MAL_Envrial_Jan18_1
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_TelegramChatBot
Create hunting rule
Link:
https://www.unpac.me/results/509aebeb-abee-461d-88e1-83ae99d184c2/
Parent samples :
7a5543f6686b1fd9aed2ab28a668e52a5e2e279eb07335e2c0f2f41b8d8f29b0
b6e88036965099c2a668babccab6718f461c41e46139f11f5c95f24bee8bea16
6911baa01a31efb2c1457d59c16d2d3ac509748d787b6790e19c70b573d4b7b8
b2ffeb59c804b4ebcfe5f80754d4b77533ace0aed1aab2dc360b6fd4ccdf041c
4bce84d45cb1c1a63ef738924c27a5c0904961307dbe305cd470c92208d283ff
SH256 hash:
8d9a36af418b8d16ae5afd26d3b0140f109dec270961e2b6b117e4b201bc534e
MD5 hash:
8ce3a8bdb31f70f737c6b8dc0ac50ad5
SHA1 hash:
9ab7bab2b9587528d2e514170bc221127b832acc
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/509aebeb-abee-461d-88e1-83ae99d184c2/
Malware family:
MassLogger
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/4bce84d45cb1/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4bce84d45cb1c1a63ef738924c27a5c0904961307dbe305cd470c92208d283ff

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BlackGuard_Rule
Create hunting rule
Author:Jiho Kim
Description:Yara rule for BlackGuarad Stealer v1.0 - v3.0
Reference:https://www.virustotal.com/gui/file/67843d45ba538eca29c63c3259d697f7e2ba84a3da941295b9207cdb01c85b71/detection
Rule name:INDICATOR_SUSPICIOUS_EXE_Embedded_Gzip_B64Encoded_File
Create hunting rule
Author:ditekSHen
Description:Detects executables containing bas64 encoded gzip files
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/20869/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (GUARD_CF)high

Comments