🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6cae8b824b6b4df9a12f953c4774abf07b33dd3a57b52a62e34bd0bbbfd5e327. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 15


Intelligence 15 IOCs YARA 22 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6cae8b824b6b4df9a12f953c4774abf07b33dd3a57b52a62e34bd0bbbfd5e327
SHA3-384 hash: c9fb21a959acf64e2aa68f1470765bfaca3b4d94f6ff4c6991a3b0946b24e0f8552e6b212dd7bb97bc2356f37538e420
SHA1 hash: 646ab2d6a0fb2bc785c6e61819573645bc24e387
MD5 hash: 53c7d5a13a8d367b11b7c22d93c03a93
humanhash: hotel-freddie-angel-july
File name:PS2025-1658_SATIN_ALMA_SİPARİŞ_FORMU_xlsx.exe
Download: download sample
Signature MassLogger
Create hunting rule
File size:684'032 bytes
First seen:2026-05-20 17:47:57 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'298 x AgentTesla, 20'717 x Formbook, 12'402 x SnakeKeylogger)
ssdeep 12288:YIwXxaguGoAKGqHqGiIUduXjxG4uLgId0kkxxbhtL7taqojL4e:/wXk3GqGqHlAH4VA6PV9Aq
Threatray 2'895 similar samples on MalwareBazaar
TLSH T1C9E412001A56AF05D0B31FF51970E2F827B4AE9EE422D3178DE57DEBBA3A7149904393
TrID 73.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
6.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.6% (.EXE) Win64 Executable (generic) (6522/11/2)
4.5% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter TomU
Tags:exe MassLogger

Intelligence

File Origin
# of uploads :
1
# of downloads :
70
Origin country :
CH CH
Vendor Threat Intelligence
Malware configuration found for:
RoboSki VIP
Details
RoboSki
a decrypted ReZer0 component and possibly a decryption component
RoboSki
a Base64 + XOR/Sub-decrypted component, its associated key, a mutex, a filename, and ReZer0 configuration parameters including: a load type, a download URL and filename (if configured), an interval (if configured), and varying flags
VIP
a communications type, a log recover type, a password, a string XOR key, decrypted strings, and based upon the communication type, one of the following: SMTP settings, FTP settings, or a Telegram URL
Link:
https://research.acce.ciphertechsolutions.com/results/902fbd06-424e-4267-9b78-4fa32add65d5/
Malware family:
n/a
ID:
1
File name:
PS2025-1658SATINALMAS_PAR__FORMU_xlsx.z
Verdict:
Suspicious activity
Analysis date:
2025-09-05 05:34:46 UTC
Tags:
arch-exec netreactor
Link:
https://app.any.run/tasks/c87ddeb8-d2e3-497c-aae7-77639e084a84

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
VIPKeyLogger
Create hunting rule
Link:
https://www.capesandbox.com/analysis/66885/
Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a0e060c4f2b29ce04020779
Tags:
underscore infosteal
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Creating a process with a hidden window
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Adding an exclusion to Microsoft Defender
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
agenttesla base64 bitmap krypt masquerade obfuscated packed packed reconnaissance roboski snakestealer stego
Link:
https://www.filescan.io/uploads/6a0df91d861ee596e641b5df/reports/d997666d-cf7b-4434-ba51-e21dafb5eb69/overview
Verdict:
Malicious
Labled as:
VIPKeylogger.Generic
Link:
https://www.hybrid-analysis.com/sample/6cae8b824b6b4df9a12f953c4774abf07b33dd3a57b52a62e34bd0bbbfd5e327
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-09-04T05:09:00Z UTC
Last seen:
2026-05-22T14:01:00Z UTC
Hits:
~1000
Link:
https://opentip.kaspersky.com/6cae8b824b6b4df9a12f953c4774abf07b33dd3a57b52a62e34bd0bbbfd5e327/results?tab=lookup
Malware family:
Snake Keylogger
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/d3352eae-d248-49ea-ba65-3aba2d4d21d4
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/6cae8b824b6b4df9a12f953c4774abf07b33dd3a57b52a62e34bd0bbbfd5e327
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6cae8b824b6b4df9a12f953c4774abf07b33dd3a57b52a62e34bd0bbbfd5e327/
Threat name:
Win32.Backdoor.FormBook
Create hunting rule
Status:
Malicious
First seen:
2025-09-04 11:32:08 UTC
File Type:
PE (.Net Exe)
Extracted files:
7
AV detection:
23 of 36 (63.89%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
unc_loader_037
Create hunting rule
wannacryptor
Create hunting rule
vipkeylogger
Create hunting rule
Similar samples:
09b8a80183a41a92c60fbacf9ee319291e37ae6d4ce0521b23b236b46e095956
MassLogger
1d2a2b5e545def1978b91058fe027033b646d1bc1876b219b0963a073141e867
MassLogger
5d02937446d2031b8d6f28d4dab29da62a1358864bca30cb1ebb3355478d3140
MassLogger
7db983607b14ea67a3d656542e033ba69fdbd3a4bcb7bea0251205d219ab71bd
MassLogger
8ece82ad36ddad1e13a955098ea9629364950ed21a1155d7be4921208e62eb0c
MassLogger
99f8a75fb301a60588d16fc659fda59f2c48cddfd2d3a730cf9a97d98b1b6023
MassLogger
faa236eaf11ddab3abe7dcc8c69613d89edf60da47060bf6dc881fa9e118cd9e
MassLogger
+ 2'885 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
discovery execution
Link:
https://tria.ge/reports/260520-wdwtcah15x/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
System Location Discovery: System Language Discovery
Checks computer location settings
Command and Scripting Interpreter: PowerShell
Unpacked files
SH256 hash:
6cae8b824b6b4df9a12f953c4774abf07b33dd3a57b52a62e34bd0bbbfd5e327
MD5 hash:
53c7d5a13a8d367b11b7c22d93c03a93
SHA1 hash:
646ab2d6a0fb2bc785c6e61819573645bc24e387
Link:
https://www.unpac.me/results/9b2f1bfd-946d-4d17-ac61-4bacc09a42c3/
SH256 hash:
78007b2dfa309c92e038f0e7a56ce9547fd239a14a6e18a4452b462c71adba0d
MD5 hash:
ad8de6128ec14274c2df52d52cb40c92
SHA1 hash:
2fad5f79f51690c61e00954a7643d244ad2d86b0
Detections:
win_404keylogger_g1
Create hunting rule
win_masslogger_w0
Create hunting rule
triage_snakekeylogger_infostealer
Create hunting rule
Link:
https://www.unpac.me/results/9b2f1bfd-946d-4d17-ac61-4bacc09a42c3/
Parent samples :
9a94e891e348c3b34f1087fc5bd0f4d54f01f7ac6c6e58ae558d24e25013587b
004dcf9aaffaca3efa1f6e0019e9205f1344cbef12efd1ed8c17ec3a43ecaee0
2366eb1c3c5a10b3782f7d6948cb6a3b43fb20e348bc9d1ac2e4a2e96b13075a
633326457f86d0a12d3ff263f3a2f4f2d8325ef94fe3f20e6d74c3f1e72f6aa6
bd1c7fec482e5cae6c29f196953329ee39b3481542738f0b1395392fb9c3ee52
faa236eaf11ddab3abe7dcc8c69613d89edf60da47060bf6dc881fa9e118cd9e
0d41bec1e1df871d2a73908ea7f03498e78f8f75a65e87a7d863e333e1d4e65f
a2baea783b7929235c15f8b354fdb7a4dc5a251c97a0c3973cedd4eaa6dccf2a
dfff02076554af2576fd4b55b593d4923e19d7a5b0596ca4162c9101bed25691
8a7744ef7ff9df61995edc1cd227d72c4ccbe86764e99f22d38ad9e6d94e9b0e
8f69a8e1be4f5d02c3600b4e41d3f70a60ac7e0d9c7f25b6268f657917c4b749
fcce017a40b3e39526c19007cdfefcd80f1cb4498abddbb552a3eed9ed37832c
cbbec8fcc0e23e23bcdce82ab97533c7b49f0bcac924cf254a2a8d02b9594ac5
dc8856f9b6ef81442715fa7dc861932df7c99bc43e9377d712927bf0ba874357
3ff5da6d0c190d3f0ea7302c6890fa56fc67f77e1db223429d0c0545e7a0cb10
6cae8b824b6b4df9a12f953c4774abf07b33dd3a57b52a62e34bd0bbbfd5e327
SH256 hash:
e50b0550616c4ea9dc2d18d75084f50e6e7da2ccaa2c77a439026957105aad8f
MD5 hash:
540148a4209d7e2b88d0e24b919c2834
SHA1 hash:
5a2042f9c9946e57d02d0d4e9a1ba2c5b1246a1e
Link:
https://www.unpac.me/results/9b2f1bfd-946d-4d17-ac61-4bacc09a42c3/
Parent samples :
881aac6c0395e173fe15acd1baf9caf443e73e166176b5040ccdb7e34750ed58
e14543458bbd96f242cc1dbeb9e3ff8c62c592fbe954b6da75fbf7f05aa41a0f
93bba3622d1594eb97ea253dbee9a1d5c495871b73410bccd6c41d7969d3b8a2
a89d88037e6e7321b7da02290aab0139ddf7be1b697388dcc28fba708304682f
e2f435485baa82011fb87477cf73d40c87b87a3579b11ea8d3cb22883ad33682
67b1c7d222568af1d3fe24c18125eac63dad102e029fae7427b7b9a526f63699
2e3c410728b3564bd615f8e6c64a7fc82fd5385542d02d7134d07bcbbc3f9f09
8ece82ad36ddad1e13a955098ea9629364950ed21a1155d7be4921208e62eb0c
26a2714342c817548962d1a9cf5ebb1aacb811c3060fea1269c8280047b8eddf
78f8b46dfdd55f7914e78f925189180f674945327ee3fa9187e2d5de86b15337
a8dabe249da520a24de691d48bf2549dda65bbb3e62cecd148b1ff0080533cac
0cb006d7434c2ffa1b04e4f20a90688e8eb36e82cea2db1641744e235995439b
fcdc9e821a1bd97c87b1c9b9fed76a070f3ff81a0ee0838f49a915336851a029
6b76abca8f35fff263c12beaaf521405a1d3743abde3bc20d8415272b2c5a140
2f76a21937582bd59783cab01437d029a6ccd52635e2a3f424831ad7e444e640
392ec2e0db217dc665b13c2e73b00d0ca2dc3b7f8a47eedf9a715d613e57a464
acfd0a48223c3e021532b6f7cfb12e81ebf2903bd706b9a5d45fb1a020dd7902
9357bf9a67240b9df693123dfcefe78bd468a313243e9ab7769c60eae161f1ad
c3bce19ca32fe499888cec1530bef701ba3d11d7fba776945a2e1245cb162a38
8e7c61db1d4aae49ddbd1ab8586fe752edbd01f30d5214e6e6bc074a3ec05588
a6fc6ac52bb2eb9fbe527ec26f3f21b8a3775660883ccd55976a250910dcee2e
227d7f535bcb6ce158d63d9436429547e9a065b289cf8b0caf8993ddd549190d
SH256 hash:
bba34994a9e03e69e505d294e1f30bae03a6fc89e4b99b6805c7a8fe78fe8b92
MD5 hash:
0f9aeaaedf87807d9d3d24e3bf4dc47a
SHA1 hash:
c63f61acdfbfb9d4a1849b390f73c4ac99f99f40
Link:
https://www.unpac.me/results/9b2f1bfd-946d-4d17-ac61-4bacc09a42c3/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6cae8b824b6b4df9a12f953c4774abf07b33dd3a57b52a62e34bd0bbbfd5e327

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_AllMal_Detector
Create hunting rule
Author:DiegoAnalytics
Description:CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication
Rule name:crime_snake_keylogger
Create hunting rule
Author:Rony (r0ny_123)
Description:Detects Snake keylogger payload
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_DotNetProcHook
Create hunting rule
Author:ditekSHen
Description:Detects executables with potential process hoocking
Rule name:INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many email and collaboration clients. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_TelegramChatBot
Create hunting rule
Author:ditekSHen
Description:Detects executables using Telegram Chat Bot
Rule name:MAL_Envrial_Jan18_1
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects Encrial credential stealer malware
Reference:https://twitter.com/malwrhunterteam/status/953313514629853184
Rule name:MAL_Envrial_Jan18_1_RID2D8C
Create hunting rule
Author:Florian Roth
Description:Detects Encrial credential stealer malware
Reference:https://twitter.com/malwrhunterteam/status/953313514629853184
Rule name:masslogger_gcch
Create hunting rule
Author:govcert_ch
Rule name:matiex
Create hunting rule
Author:Michelle Khalil
Description:This rule detects unpacked matiex malware samples.
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:telegram_bot_api
Create hunting rule
Author:rectifyq
Description:Detects file containing Telegram Bot API
Rule name:Windows_Trojan_SnakeKeylogger_af3faa65
Create hunting rule
Author:Elastic Security
Rule name:win_masslogger_w0
Create hunting rule
Author:govcert_ch

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

Executable exe 6cae8b824b6b4df9a12f953c4774abf07b33dd3a57b52a62e34bd0bbbfd5e327

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/66885/

Comments