MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 80edf30940ba58cb632cb8b5bbed7f57df1dbc9c682ddc744b9ed44af3583db8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 16


Intelligence 16 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 80edf30940ba58cb632cb8b5bbed7f57df1dbc9c682ddc744b9ed44af3583db8
SHA3-384 hash: 0207a01cf126022cc7368be1c627e404f629c3d3f89b0203b5c883cfef3d4217f1d1a0f989f04b8b0943a1825cb877c9
SHA1 hash: 0b08a3b0117479d50e8f7c47cbe280cf696ef659
MD5 hash: 488e421f0a5d2912620f7453c844527f
humanhash: zebra-eighteen-avocado-ink
File name:REQ NO. 88484.exe
Download: download sample
Signature MassLogger
Create hunting rule
File size:638'464 bytes
First seen:2025-04-07 04:03:38 UTC
Last seen:2025-04-07 04:30:39 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:zYJYqBCCwfGs6MP6ObgU+NknkzZzmLHokVlm4BmpKckU/Q2Ddtu:xf+HO+CnkzYLHokl4VBD
TLSH T1BFD4DF6433ADEC03C4B652F54820D27403B59DAA7A22E3C6ADDABDDB7CE0F4559007A7
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10522/11/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
dhash icon 0068617171617000 (6 x SnakeKeylogger, 2 x MassLogger, 2 x AgentTesla)
Reporter threatcat_ch
Tags:exe MassLogger

Intelligence

File Origin
# of uploads :
2
# of downloads :
488
Origin country :
CH CH
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
REQ NO. 88484.exe
Verdict:
Malicious activity
Analysis date:
2025-04-07 04:06:06 UTC
Tags:
snake keylogger evasion stealer netreactor
Link:
https://app.any.run/tasks/b6f67404-35bd-42f2-a4df-8fe9d6ae8c5e

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/954/
Detection(s):
SecuriteInfo.com.Win32.CrypterX-gen.20996.2357.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
92.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=67f34ee8e011fe619fabce0c
Tags:
backdoor botnet hype
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Сreating synchronization primitives
DNS request
Connection attempt
Sending an HTTP GET request
Sending a custom TCP request
Reading critical registry keys
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed packed packer_detected vbnet
Link:
https://www.filescan.io/uploads/67f34eb82d430c849e09942d/reports/0d844103-2fa4-446a-9e51-69950232eb17/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/80edf30940ba58cb632cb8b5bbed7f57df1dbc9c682ddc744b9ed44af3583db8
Malware family:
Snake Keylogger
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/f0536d22-1a39-4adf-b912-68412e5c357f
Result
Threat name:
MSIL Logger, MassLogger RAT, PureLog Ste
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1657999
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
Contains functionality to log keystrokes (.Net Source)
Found malware configuration
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Tries to detect the country of the analysis system (by using the IP)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected AntiVM3
Yara detected MassLogger RAT
Yara detected MSIL Logger
Yara detected PureLog Stealer
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/80edf30940ba58cb632cb8b5bbed7f57df1dbc9c682ddc744b9ed44af3583db8
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/80edf30940ba58cb632cb8b5bbed7f57df1dbc9c682ddc744b9ed44af3583db8/
Threat name:
ByteCode-MSIL.Backdoor.FormBook
Create hunting rule
Status:
Malicious
First seen:
2025-04-07 04:04:06 UTC
File Type:
PE (.Net Exe)
Extracted files:
21
AV detection:
19 of 24 (79.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=qdw7gckaxjmmwyzmxc23x3l7k7pr3pe4naw5y5clt3kev42yhw4a._file
Verdict:
malicious
Label(s):
unc_loader_037
Create hunting rule
novastealer
Create hunting rule
Similar samples:
error
MassLogger
Result
Malware family:
n/a
Score:
  7/10
Tags:
collection discovery spyware stealer
Link:
https://tria.ge/reports/250407-emzg6a1ks4/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Verdict:
Suspicious
Tags:
404keylogger
YARA:
n/a
Link:
https://app.threat.zone/submission/c91b9ec9-1d0e-41d6-be76-322eef97b6d6
Unpacked files
SH256 hash:
80edf30940ba58cb632cb8b5bbed7f57df1dbc9c682ddc744b9ed44af3583db8
MD5 hash:
488e421f0a5d2912620f7453c844527f
SHA1 hash:
0b08a3b0117479d50e8f7c47cbe280cf696ef659
Link:
https://www.unpac.me/results/9ce5f274-8934-4599-b713-1879aafc0803/
SH256 hash:
aaf264fd20a2c91f95b3e6a1b72fd5c5fb8a4712a32a24a5a36c7a84efd1023d
MD5 hash:
79ce0ae8782467912741d1d18b6b87c9
SHA1 hash:
044a87447c7fe423e72c1ac497c50db7ffc0f0c0
Link:
https://www.unpac.me/results/9ce5f274-8934-4599-b713-1879aafc0803/
SH256 hash:
55e7d4700ef6760575e2e691beee157a312bee534c5b72b47f3a30518a621300
MD5 hash:
2a47f7b9de27ca900d9874dbe12f996f
SHA1 hash:
42673aeb1b9e1728a2ea27074adcf540b124834e
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/9ce5f274-8934-4599-b713-1879aafc0803/
SH256 hash:
9bfee8e8eacbdf8a3d067a6c57d2c49c32c376bebbb18a1c67a2361cfe0ba3ec
MD5 hash:
1a23df2adaeda6ed0dcab8bca48acdd2
SHA1 hash:
82c3844cfa96891b9146c1c43245d5ca77923835
Detections:
win_404keylogger_g1
Create hunting rule
win_masslogger_w0
Create hunting rule
MAL_Envrial_Jan18_1
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_TelegramChatBot
Create hunting rule
Link:
https://www.unpac.me/results/9ce5f274-8934-4599-b713-1879aafc0803/
Malware family:
zgRAT
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/80edf30940ba/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/80edf30940ba58cb632cb8b5bbed7f57df1dbc9c682ddc744b9ed44af3583db8

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

Executable exe 80edf30940ba58cb632cb8b5bbed7f57df1dbc9c682ddc744b9ed44af3583db8

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/954/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments