MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6fbe5f3b1d94c0f1d75b94eefb0f50d8dcaa6579b97b426ff0500a55dba79cf0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 20


Intelligence 20 IOCs YARA 24 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6fbe5f3b1d94c0f1d75b94eefb0f50d8dcaa6579b97b426ff0500a55dba79cf0
SHA3-384 hash: 5dd7c4866700301ecc7b5b81798f56c6467f5522968f7f7f6086a041e709fefe372f9c7f5762e014dfe6e107d1e3b290
SHA1 hash: c65170d1e241c8a7696c70614de6c755fa143afb
MD5 hash: 6165f921c420274c1c11e4bd4e8b357f
humanhash: august-mike-maryland-violet
File name:dwn.exe
Download: download sample
Signature MassLogger
Create hunting rule
File size:1'046'016 bytes
First seen:2025-12-17 10:06:43 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 1895460fffad9475fda0c84755ecfee1 (438 x Formbook, 137 x AgentTesla, 67 x a310Logger)
ssdeep 24576:T5EmXFtKaL4/oFe5T9yyXYfP1ijXdagtXuIQ:TPVt/LZeJbInQRagh
TLSH T1D525AE0273D1C062FFAB92334B5AF6115BBC79260127A62F13981DB9BD701B1563E7A3
TrID 40.3% (.EXE) Win64 Executable (generic) (10522/11/4)
19.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
17.2% (.EXE) Win32 Executable (generic) (4504/4/1)
7.7% (.EXE) OS/2 Executable (generic) (2029/13)
7.6% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
Reporter proxylife
Tags:exe MassLogger

Intelligence

File Origin
# of uploads :
1
# of downloads :
134
Origin country :
NL NL
Vendor Threat Intelligence
Malware configuration found for:
AutoIt
Details
AutoIt
extracted scripts and files
Link:
https://research.acce.ciphertechsolutions.com/results/c815a385-bea9-45b0-aae5-8c0745524d23/
Malware family:
remcos
Create hunting rule
ID:
1
File name:
7180d68d85b38121e92c0a041863efe9a32e66252876dbeb8a4f5e86510f2fcd
Verdict:
Malicious activity
Analysis date:
2025-12-08 23:33:21 UTC
Tags:
rat remcos delphi auto-sch remote stealer auto-startup snake keylogger evasion mpress tool
Link:
https://app.any.run/tasks/01daf35b-6331-4961-91cf-8fccc7908687

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/45308/
Detection(s):
Win.Dropper.Zeus-9996119-0
Create hunting rule

SecuriteInfo.com.Win32.Trojan.Agent.35E5V6.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=694280e0c97f4a807a3b89c7
Tags:
nymeria autorun autoit emotet
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %temp% directory
Creating a file
Creating a process from a recently created file
Launching a process
Сreating synchronization primitives
DNS request
Connection attempt
Sending an HTTP GET request
Sending a custom TCP request
Reading critical registry keys
Stealing user critical data
Enabling autorun by creating a file
Unauthorized injection to a system process
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
adaptive-context anti-debug autoit compiled-script fingerprint keylogger microsoft_visual_cc nymeria packed zeus
Link:
https://www.filescan.io/uploads/694280d03f8fdbf8e9493232/reports/f886541c-d77d-499c-9b5c-2040481cbdaa/overview
Verdict:
Malicious
Labled as:
AIT:Trojan.Nymeria
Link:
https://www.hybrid-analysis.com/sample/6fbe5f3b1d94c0f1d75b94eefb0f50d8dcaa6579b97b426ff0500a55dba79cf0
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-12-14T12:21:00Z UTC
Last seen:
2025-12-17T19:39:00Z UTC
Hits:
~10
Detections:
Trojan-Spy.MSIL.BPLogger.lp Trojan-PSW.Win32.Stelega.sb Trojan.Win32.Inject.sb Trojan.Win32.Auzenpak.sb PDM:Trojan.Win32.Generic Trojan-Spy.MSIL.BPLogger.sb Trojan-PSW.Win32.Stealer.sb Trojan.Win32.Zenpak.sb Trojan.Win32.Strab.sb
Link:
https://opentip.kaspersky.com/6fbe5f3b1d94c0f1d75b94eefb0f50d8dcaa6579b97b426ff0500a55dba79cf0/results?tab=lookup
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/c98c198c-2181-4048-8e65-976805472282
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/6fbe5f3b1d94c0f1d75b94eefb0f50d8dcaa6579b97b426ff0500a55dba79cf0
Verdict:
Malware
YARA:
6 match(es)
Tags:
AutoIt Decompiled Executable PDB Path PE (Portable Executable) PE File Layout Suspect Win 32 Exe x86
Link:
https://app.malva.re/file/6165f921c420274c1c11e4bd4e8b357f
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6fbe5f3b1d94c0f1d75b94eefb0f50d8dcaa6579b97b426ff0500a55dba79cf0/
Verdict:
Malicious
Threat:
Family.SNAKE
Link:
https://tip.neiki.dev/file/6fbe5f3b1d94c0f1d75b94eefb0f50d8dcaa6579b97b426ff0500a55dba79cf0
Threat name:
Win32.Trojan.AutoitInject
Create hunting rule
Status:
Malicious
First seen:
2025-12-14 18:45:59 UTC
File Type:
PE (Exe)
Extracted files:
28
AV detection:
17 of 23 (73.91%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=n67f6oy5stapdv23stxpwd2q3dokuzlzxf5ue37qkafflw5httya._file
Verdict:
malicious
Label(s):
novastealer
Create hunting rule
Similar samples:
error
MassLogger
Result
Malware family:
masslogger
Create hunting rule
Score:
  10/10
Tags:
family:masslogger collection discovery spyware stealer
Link:
https://tria.ge/reports/251217-l5q23aslez/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
System Location Discovery: System Language Discovery
AutoIT Executable
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Drops startup file
Executes dropped EXE
MassLogger
Masslogger family
Verdict:
Malicious
Tags:
Win.Dropper.Zeus-9996119-0
YARA:
n/a
Link:
https://app.threat.zone/submission/ce1b010a-d955-44d2-a8fa-596cf8cf5bd2
Unpacked files
SH256 hash:
6fbe5f3b1d94c0f1d75b94eefb0f50d8dcaa6579b97b426ff0500a55dba79cf0
MD5 hash:
6165f921c420274c1c11e4bd4e8b357f
SHA1 hash:
c65170d1e241c8a7696c70614de6c755fa143afb
Link:
https://www.unpac.me/results/60d9aa44-5631-4d63-aae9-ae96f3765bb5/
SH256 hash:
09c5393ed1a2c5bff15250e96bf3dec93b3160fb00e1cb6514f869555cf4cad7
MD5 hash:
1b5a1c3393ea0a4f6ee8ce1673f14eee
SHA1 hash:
7ea33699f9996aef740117572fb0b0d8fa8a9c33
Detections:
win_404keylogger_g1
Create hunting rule
win_masslogger_w0
Create hunting rule
MAL_Envrial_Jan18_1
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_TelegramChatBot
Create hunting rule
Link:
https://www.unpac.me/results/60d9aa44-5631-4d63-aae9-ae96f3765bb5/
Malware family:
PrivateLogger
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/6fbe5f3b1d94/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6fbe5f3b1d94c0f1d75b94eefb0f50d8dcaa6579b97b426ff0500a55dba79cf0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AutoIT_Compiled
Create hunting rule
Author:@bartblaze
Description:Identifies compiled AutoIT script (as EXE). This rule by itself does NOT necessarily mean the detected file is malicious.
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:crime_snake_keylogger
Create hunting rule
Author:Rony (r0ny_123)
Description:Detects Snake keylogger payload
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_TelegramChatBot
Create hunting rule
Author:ditekSHen
Description:Detects executables using Telegram Chat Bot
Rule name:MAL_Envrial_Jan18_1
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects Encrial credential stealer malware
Reference:https://twitter.com/malwrhunterteam/status/953313514629853184
Rule name:MAL_Envrial_Jan18_1_RID2D8C
Create hunting rule
Author:Florian Roth
Description:Detects Encrial credential stealer malware
Reference:https://twitter.com/malwrhunterteam/status/953313514629853184
Rule name:masslogger_gcch
Create hunting rule
Author:govcert_ch
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:TelegramAPIMalware_PowerShell_EXE
Create hunting rule
Author:@polygonben
Description:Hunting for pwsh malware using Telegram for C2
Rule name:telegram_bot_api
Create hunting rule
Author:rectifyq
Description:Detects file containing Telegram Bot API
Rule name:TH_Generic_MassHunt_Win_Malware_2025_CYFARE
Create hunting rule
Author:CYFARE
Description:Generic Windows malware mass-hunt rule - 2025
Reference:https://cyfare.net/
Rule name:Windows_Trojan_SnakeKeylogger_af3faa65
Create hunting rule
Author:Elastic Security
Rule name:win_masslogger_w0
Create hunting rule
Author:govcert_ch

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/45308/

Comments