MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 58a5531bd59d978ac4da691ff92bc8e321a5e58200f66c10046b2e7c2edd07f4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 15


Intelligence 15 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 58a5531bd59d978ac4da691ff92bc8e321a5e58200f66c10046b2e7c2edd07f4
SHA3-384 hash: 11dcb66fc2726affa8f241c65788a14403468db5bb9a25649402cac37d52d7e18955d9fcbe5997e163f9bc8dcc53198f
SHA1 hash: 2aa2f94df25d83863d9bdf9ed2b9c8e89bfe2611
MD5 hash: db54863d3532e2cb497a8983e07af9c5
humanhash: timing-monkey-jersey-eleven
File name:58a5531bd59d978ac4da691ff92bc8e321a5e58200f66c10046b2e7c2edd07f4
Download: download sample
Signature MassLogger
Create hunting rule
File size:939'520 bytes
First seen:2026-05-08 12:23:19 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'994 x AgentTesla, 19'900 x Formbook, 12'331 x SnakeKeylogger)
ssdeep 12288:1JmKJhgFvLGwKXAaIVyw/9etzZMNtd9HSnTGeH0VbWm7sF82vcwALe0H39P1z8AV:1/wOASw/wtzZMNj9HSnvHDOLp9X9Bn
Threatray 2'156 similar samples on MalwareBazaar
TLSH T1F215F1442269D902D0A76FF40970E3B407B96D89A821D317CEF6BDDBBC3E795580A2D3
TrID 21.4% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
21.2% (.EXE) Win64 Executable (generic) (6522/11/2)
16.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
14.6% (.EXE) Win32 Executable (generic) (4504/4/1)
6.6% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter adrian__luca
Tags:exe MassLogger

Intelligence

File Origin
# of uploads :
1
# of downloads :
58
Origin country :
HU HU
Vendor Threat Intelligence
Malware configuration found for:
RoboSki
Details
Link:
https://research.acce.ciphertechsolutions.com/results/2e1bc545-2381-4692-9acc-578df9028a43/
Malware family:
n/a
ID:
1
File name:
exe
Verdict:
Malicious activity
Analysis date:
2026-05-08 13:00:23 UTC
Tags:
snake keylogger evasion auto-startup stealer
Link:
https://app.any.run/tasks/b8bcf6d6-5263-44b0-8ff9-9fec609e7e1e

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/64948/
Detection(s):
Win.Packed.Malwarex-10059865-0
Create hunting rule

Gathering data
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Сreating synchronization primitives
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Creating a file in the %temp% directory
Launching a process
Creating a file
DNS request
Connection attempt
Sending an HTTP GET request
Reading critical registry keys
Stealing user critical data
Enabling autorun by creating a file
Unauthorized injection to a system process
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
lolbin obfuscated packed soft-404 tracker vbnet
Link:
https://www.filescan.io/uploads/69fdd5c89b72a1a5304c605f/reports/25787f20-5e6c-488f-b46b-d7bf4801bccc/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/58a5531bd59d978ac4da691ff92bc8e321a5e58200f66c10046b2e7c2edd07f4
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-03-31T05:08:00Z UTC
Last seen:
2026-04-20T08:07:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/58a5531bd59d978ac4da691ff92bc8e321a5e58200f66c10046b2e7c2edd07f4/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/5c267411-9c62-4c0e-ac4b-1d3aec345706
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/58a5531bd59d978ac4da691ff92bc8e321a5e58200f66c10046b2e7c2edd07f4
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/58a5531bd59d978ac4da691ff92bc8e321a5e58200f66c10046b2e7c2edd07f4/
Threat name:
ByteCode-MSIL.Trojan.DarkCloud
Create hunting rule
Status:
Malicious
First seen:
2026-03-31 08:26:28 UTC
File Type:
PE (.Net Exe)
Extracted files:
7
AV detection:
19 of 24 (79.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=lcsvgg6vtwlyvrg2nep7sk6i4mq2lzmcad3gyeaenmxhylw5a72a._file
Verdict:
malicious
Label(s):
novastealer
Create hunting rule
Similar samples:
009391083b79de327fc9b8b66f7ff3dac490adfb18c89727d6298090fc5a0e60
MassLogger
10d96a57b4a446b30816229307984a151f1d319eb8e25fdffb0b6185055f778a
MassLogger
4c52b95de38389ec565fb084cc103bf23a1282c07c0e70ed0040b252baf80452
MassLogger
8019571058646e96e886875801a1711842d8974f24b413ff8b620c05aa08b59a
MassLogger
864c37e89869ea3662f720df0acabf8cee0c861b5b908515f805746b432a7260
MassLogger
8a03ad25b92ea66d934e83e49072b8dd1147bda79fc057b38fac8aaaf850566c
MassLogger
94dde278918e0eab10c0a5818653f73a779d19632fa3f6e603f146bcf709e732
MassLogger
error
MassLogger
fd2a48d552d870aee951d4ab01b6a3ac73d2b6004e8a1a238de3a237599e0cb6
MassLogger
+ 2'146 additional samples on MalwareBazaar
Result
Malware family:
masslogger
Create hunting rule
Score:
  10/10
Tags:
family:masslogger collection discovery spyware stealer
Link:
https://tria.ge/reports/260508-pkv23acv7n/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Drops startup file
Family: MassLogger
Unpacked files
SH256 hash:
58a5531bd59d978ac4da691ff92bc8e321a5e58200f66c10046b2e7c2edd07f4
MD5 hash:
db54863d3532e2cb497a8983e07af9c5
SHA1 hash:
2aa2f94df25d83863d9bdf9ed2b9c8e89bfe2611
Link:
https://www.unpac.me/results/f65b1f5d-3ead-415f-9626-a3549ebd47a8/
SH256 hash:
df2363b716063f73bdd8194f4ef888ee48987ebebeb68f1b5c82f4742ea65f3a
MD5 hash:
35965f904cbe35091de664e70079202a
SHA1 hash:
236579aea78411ed47baac59301d30d594d39a1e
Link:
https://www.unpac.me/results/f65b1f5d-3ead-415f-9626-a3549ebd47a8/
SH256 hash:
7330fe1b40667d8ca67394f472d151f08abc0774a6d5b1b064bc6f26463a0244
MD5 hash:
bbf2b7752065c505815ffef5dc70f676
SHA1 hash:
39810436a474a614f136acc140e60c09ab7e955e
Detections:
win_404keylogger_g1
Create hunting rule
win_masslogger_w0
Create hunting rule
triage_snakekeylogger_infostealer
Create hunting rule
Link:
https://www.unpac.me/results/f65b1f5d-3ead-415f-9626-a3549ebd47a8/
Parent samples :
d7fde69a82dd7aabc7582e97f6906ff0ee92ed4ead6a2486d7c19c6807206a9d
f91e05ca439cfe5e0e7bc5d552d9157ab449c10cd0680e6cdd1d038a3eba687c
baa7fa2f8240a086a67d051d75a007f1d015fab766b850e6cac60533323b6d85
58a5531bd59d978ac4da691ff92bc8e321a5e58200f66c10046b2e7c2edd07f4
8a03ad25b92ea66d934e83e49072b8dd1147bda79fc057b38fac8aaaf850566c
692a4df2ae72a96a0451e5a4f8fcada0801e89fe8ee76f71c94df11ac8700e55
SH256 hash:
bcdfab43ffabe89d4de53fcc637c83a3fde43aec189a13a7a80c82f8ec6e027e
MD5 hash:
7dd939ad1e7953ecc90bce0a5af4e321
SHA1 hash:
4a907708ab0bb6148db072630e6fb91b8be60872
Link:
https://www.unpac.me/results/f65b1f5d-3ead-415f-9626-a3549ebd47a8/
Malware family:
MassLogger
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/58a5531bd59d/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/58a5531bd59d978ac4da691ff92bc8e321a5e58200f66c10046b2e7c2edd07f4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/64948/

Comments