MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5d16ece654d58afcb6b04849ee6655c2f709e68c6b65b6c6a26a0e9cf33bc52b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 16


Intelligence 16 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5d16ece654d58afcb6b04849ee6655c2f709e68c6b65b6c6a26a0e9cf33bc52b
SHA3-384 hash: 14bfe0e44f2893f27b9b304c52b3dba4f054b6d53c3a33d512d58b763b2b4973cda57d07b8bbc92fae0ffde68b76f29a
SHA1 hash: 1fbd41d778038456fa1d075b8e998ebba34251ea
MD5 hash: 838eaeb16876be091193c1f75a63d3cc
humanhash: queen-blue-vegan-london
File name:5d16ece654d58afcb6b04849ee6655c2f709e68c6b65b6c6a26a0e9cf33bc52b
Download: download sample
Signature MassLogger
Create hunting rule
File size:1'432'576 bytes
First seen:2025-12-08 14:46:15 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'845 x AgentTesla, 19'775 x Formbook, 12'298 x SnakeKeylogger)
ssdeep 24576:rE40nOqWWvSXwQfKxzFtd2MJVdjk0jdh+bAWaFoj3u6ple1RTs:rEHO7WysxzFtMOtAsWaG3uUeX
Threatray 3'783 similar samples on MalwareBazaar
TLSH T16C652314315ECB17C47A17F41DA0E0BA17B56FBA2A22D7061DEB3DCF786AB410A41B63
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10522/11/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter adrian__luca
Tags:exe MassLogger

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
HU HU
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/50bb04e0-de5c-449d-aa53-0a103a46b673/
Malware family:
n/a
ID:
1
File name:
5d16ece654d58afcb6b04849ee6655c2f709e68c6b65b6c6a26a0e9cf33bc52b
Verdict:
Malicious activity
Analysis date:
2025-12-08 16:50:36 UTC
Tags:
snake keylogger stealer evasion ims-api generic
Link:
https://app.any.run/tasks/e0317376-1af9-4635-9207-be17b3f09758

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/43159/
Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6936e50edb58e1a2c22b8497
Tags:
virus micro msil
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/5d16ece654d58afcb6b04849ee6655c2f709e68c6b65b6c6a26a0e9cf33bc52b
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-11-12T05:53:00Z UTC
Last seen:
2025-12-04T20:24:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/5d16ece654d58afcb6b04849ee6655c2f709e68c6b65b6c6a26a0e9cf33bc52b/results?tab=lookup
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/b703f677-a5f9-407c-bb67-8e3501f7fe45
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/5d16ece654d58afcb6b04849ee6655c2f709e68c6b65b6c6a26a0e9cf33bc52b
Verdict:
inconclusive
YARA:
10 match(es)
Tags:
.Net Executable Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.29 Win 32 Exe x86
Link:
https://app.malva.re/file/838eaeb16876be091193c1f75a63d3cc
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5d16ece654d58afcb6b04849ee6655c2f709e68c6b65b6c6a26a0e9cf33bc52b/
Threat name:
Win32.Trojan.Leonem
Create hunting rule
Status:
Malicious
First seen:
2025-11-12 12:34:24 UTC
AV detection:
19 of 24 (79.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=lulozzsu2wfpznvqjbe64zsvyl3qtzumnns3nrvcnihjz4z3yuvq._file
Verdict:
malicious
Label(s):
novastealer
Create hunting rule
unc_loader_037
Create hunting rule
Similar samples:
3f2a428fd841cfcc962fc2f384208a4226845394bb253341dbe1fff05069a2c8
MassLogger
55011c7e77605612e1386d23d2bb03623326bd041c077e7913d02b16f9dd854a
MassLogger
9f11a53f99a46a3f038bbc277cb935090d521731ef806b4e9ad5cde9bcac9e0e
MassLogger
baa4644728c7e2bb52305701569700be80e76adf9a50bdca2faa54eed64cfc9f
MassLogger
e891403f8727f8c2c54ae409611a0e5e1d3ff015d3172156b761a908bb40b177
MassLogger
error
MassLogger
+ 3'773 additional samples on MalwareBazaar
Result
Malware family:
masslogger
Create hunting rule
Score:
  10/10
Tags:
family:masslogger collection discovery spyware stealer
Link:
https://tria.ge/reports/251208-r5jwmsez3d/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Reads user/profile data of local email clients
Reads user/profile data of web browsers
MassLogger
Masslogger family
Malware Config
C2 Extraction:
https://api.telegram.org/bot8444333453:AAHge7NyKHU_EwZxbErc1RxR1KxrAEpHz_M/sendMessage?chat_id=7785719799
Verdict:
Malicious
Tags:
404Keylogger
YARA:
n/a
Link:
https://app.threat.zone/submission/ed8a57ea-ac34-4232-86b3-ddaea2f340cb
Unpacked files
SH256 hash:
5d16ece654d58afcb6b04849ee6655c2f709e68c6b65b6c6a26a0e9cf33bc52b
MD5 hash:
838eaeb16876be091193c1f75a63d3cc
SHA1 hash:
1fbd41d778038456fa1d075b8e998ebba34251ea
Link:
https://www.unpac.me/results/87648f3e-1a60-435e-87a4-4f3d61d740b3/
SH256 hash:
4a5c480a6236d14e82d415a1a86269720d7db52055bd2849305271615ccf94b2
MD5 hash:
c543fa98a0063ea4cd16e3fcc6a52660
SHA1 hash:
5441d9fd47cb794866530e36de80c52cc7039162
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/87648f3e-1a60-435e-87a4-4f3d61d740b3/
SH256 hash:
f44a97ba959a2f1b2154d69c4d118fd16bc5608f7f1dcf4f36bd44c6543b3b9a
MD5 hash:
64a9dd1563f828735d8bb70617bd4d5a
SHA1 hash:
85cfa4ff543dc85b7c8247876c9a8bee99cd9091
Link:
https://www.unpac.me/results/87648f3e-1a60-435e-87a4-4f3d61d740b3/
SH256 hash:
10497c45b30fa7f8e57be45ba80bf1efbebc2636db24c6cb1bb03fa19818391e
MD5 hash:
23d6830ccf585b88ccbd90d33c022ac7
SHA1 hash:
b2509125f02f11c26951639d33d6233d9cd1bef9
Link:
https://www.unpac.me/results/87648f3e-1a60-435e-87a4-4f3d61d740b3/
SH256 hash:
b794ed0c0c7d4499d0a2ffff67eb5b92dba83f4be7964591e9edad2755176511
MD5 hash:
2a576318d07470206dd7c45f7d896078
SHA1 hash:
3096b2a5ccd98583949a9f57842d5547b50bbc29
Link:
https://www.unpac.me/results/87648f3e-1a60-435e-87a4-4f3d61d740b3/
SH256 hash:
cc5f24254350046231b7fe9b60a54b08b5b318797d0012b20f0c6b3391da6c28
MD5 hash:
7809bbfc629d45130607a0c5effc3dbc
SHA1 hash:
83b8307901d44e861bc635d24b071888643fdb87
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/87648f3e-1a60-435e-87a4-4f3d61d740b3/
SH256 hash:
a6aed5bb77bb9fdd38a1b664b6549c79da4c882bade86a3a3b2c3e8eb02ff56e
MD5 hash:
91549db3da30b91712adf78a5837e6ee
SHA1 hash:
f96a62be7ff56e3156268a8806891d686ffe3071
Link:
https://www.unpac.me/results/87648f3e-1a60-435e-87a4-4f3d61d740b3/
SH256 hash:
cc2b98223c9dcaf35c31d2eb743780aa3ea50177043e82633dda11aa7b7ff66b
MD5 hash:
014ace331af3642ddb3d3aa754e94950
SHA1 hash:
2ee54a101d1817ffdf1154d6bc19a7fa6db81c97
Link:
https://www.unpac.me/results/87648f3e-1a60-435e-87a4-4f3d61d740b3/
SH256 hash:
df1d946377cb1a0fe66acafa5be72d9d14126a0271f5afb995419c705ae8995c
MD5 hash:
9970322c64842106caae0b2717c495b2
SHA1 hash:
76efdfee4acfed23c5ba7141f0116114875f21e2
Detections:
win_404keylogger_g1
Create hunting rule
win_masslogger_w0
Create hunting rule
MAL_Envrial_Jan18_1
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_TelegramChatBot
Create hunting rule
Link:
https://www.unpac.me/results/87648f3e-1a60-435e-87a4-4f3d61d740b3/
Parent samples :
55011c7e77605612e1386d23d2bb03623326bd041c077e7913d02b16f9dd854a
5d16ece654d58afcb6b04849ee6655c2f709e68c6b65b6c6a26a0e9cf33bc52b
SH256 hash:
10d842a69fb0ccc49d5d903718b88b75ee59b2088cb62af2d89682b0b3176f0c
MD5 hash:
f72c866b35be39ccf903ce9db9f8fece
SHA1 hash:
a18fe959b67369b25075246a0712f287707e0e4c
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/87648f3e-1a60-435e-87a4-4f3d61d740b3/
Parent samples :
55011c7e77605612e1386d23d2bb03623326bd041c077e7913d02b16f9dd854a
5d16ece654d58afcb6b04849ee6655c2f709e68c6b65b6c6a26a0e9cf33bc52b
Malware family:
PrivateLogger
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/5d16ece654d5/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5d16ece654d58afcb6b04849ee6655c2f709e68c6b65b6c6a26a0e9cf33bc52b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/43159/

Comments