MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8ce3032c5fe1599125d89ac1f9a942e7f235b319054378d20021ed4ea73bfda4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 13


Intelligence 13 IOCs YARA 43 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8ce3032c5fe1599125d89ac1f9a942e7f235b319054378d20021ed4ea73bfda4
SHA3-384 hash: eb2b5af403523a3f76b9311bf5b7ad17f1a3b9a6091de211090806e4c2e760ab24f512c4dcfab5d28e4ac1eb4234bec0
SHA1 hash: 74f65a19f71192292de2e52582cde4684b880222
MD5 hash: 4d81397beb6e83ff5b0e8a0a6eafec5f
humanhash: early-georgia-maine-five
File name:DAS VIET NAM GLOBAL - DRYDOCK SS3, CARGO TANK BULKHEAD REPAIR.xlsx.exe
Download: download sample
Signature MassLogger
Create hunting rule
File size:40'516'953 bytes
First seen:2025-03-18 11:01:06 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 66b10d8b5718b0fd6fb4865843d44280 (9 x FixStealer, 4 x AsyncRAT, 3 x NodeLoader)
ssdeep 393216:376L6otUitqtH7wHtXq2pt2jbOCacCFIK0fpP9HF4VW8yf5nVQx4urYsANulL7Nn:30LoCOn+25s4urYDNulLBiub
Threatray 711 similar samples on MalwareBazaar
TLSH T187979C0372E60095E8B7D2388AA75103D773B8635731DACF725D06152FBBAD4AA7B720
TrID 63.5% (.EXE) Win64 Executable (generic) (10522/11/4)
12.2% (.EXE) OS/2 Executable (generic) (2029/13)
12.0% (.EXE) Generic Win/DOS Executable (2002/3)
12.0% (.EXE) DOS Executable Generic (2000/1)
Magika pebin
dhash icon d4d4d2d2d6dcc4d4 (1 x MassLogger)
Reporter TeamDreier
Tags:exe MassLogger

Intelligence

File Origin
# of uploads :
1
# of downloads :
412
Origin country :
DK DK
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
DAS VIET NAM GLOBAL - DRYDOCK SS3, CARGO TANK BULKHEAD REPAIR.xlsx.exe
Verdict:
Malicious activity
Analysis date:
2025-03-18 11:09:31 UTC
Tags:
snake keylogger evasion stealer nodejs
Link:
https://app.any.run/tasks/9bc4b50b-1f32-40b4-94f8-93f1aa8fd461

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=67d95a93194f23322a70b72d
Tags:
underscore emotet
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
Creating a process from a recently created file
Creating a process with a hidden window
Launching a process
Сreating synchronization primitives
DNS request
Connection attempt
Sending an HTTP GET request
Sending a custom TCP request
Reading critical registry keys
Creating a window
Unauthorized injection to a system process
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
adaptive-context anti-debug anti-vm crypto evasive expand fingerprint lolbin masquerade microsoft_visual_cc overlay packed pkg
Link:
https://www.filescan.io/uploads/67d9527d0a7899f3579babc8/reports/335ef96d-5c0a-4753-b628-c4fd856172b1/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/8ce3032c5fe1599125d89ac1f9a942e7f235b319054378d20021ed4ea73bfda4
Result
Verdict:
UNKNOWN
Result
Threat name:
MSIL Logger, MassLogger RAT
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1641677
Signature
.NET source code references suspicious native API functions
Allocates memory in foreign processes
Contains functionality to log keystrokes (.Net Source)
Found malware configuration
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sigma detected: Suspicious Double Extension File Execution
Tries to detect the country of the analysis system (by using the IP)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses an obfuscated file name to hide its real file extension (double extension)
Writes to foreign memory regions
Yara detected MassLogger RAT
Yara detected MSIL Logger
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1641677 Sample: DAS VIET NAM GLOBAL - DRYDO... Startdate: 18/03/2025 Architecture: WINDOWS Score: 100 34 reallyfreegeoip.org 2->34 36 mail.phobinh.com.vn 2->36 38 3 other IPs or domains 2->38 44 Found malware configuration 2->44 46 Malicious sample detected (through community Yara rule) 2->46 48 Multi AV Scanner detection for submitted file 2->48 52 8 other signatures 2->52 8 DAS VIET NAM GLOBAL - DRYDOCK SS3, CARGO TANK BULKHEAD REPAIR.xlsx.exe 17 2->8         started        signatures3 50 Tries to detect the country of the analysis system (by using the IP) 34->50 process4 file5 20 C:\Users\user\AppData\Local\...\scan_noev.exe, PE32+ 8->20 dropped 22 C:\Users\user\AppData\...\nasrallah_x86.dll, data 8->22 dropped 24 C:\Users\user\AppData\Local\...\msvcp290.dll, PE32+ 8->24 dropped 26 11 other files (none is malicious) 8->26 dropped 11 scan_noev.exe 8->11         started        14 conhost.exe 8->14         started        process6 signatures7 54 Writes to foreign memory regions 11->54 56 Allocates memory in foreign processes 11->56 58 Injects a PE file into a foreign processes 11->58 16 AddInProcess32.exe 15 2 11->16         started        process8 dnsIp9 28 mail24430.maychuemail.com 123.30.244.30, 49684, 587 VNPT-AS-VNVietnamPostsandTelecommunicationsVNPTVN Viet Nam 16->28 30 checkip.dyndns.com 132.226.247.73, 49682, 80 UTMEMUS United States 16->30 32 reallyfreegeoip.org 104.21.112.1, 443, 49683 CLOUDFLARENETUS United States 16->32 40 Tries to steal Mail credentials (via file / registry access) 16->40 42 Tries to harvest and steal browser information (history, passwords, etc) 16->42 signatures10
Score:
67%
Verdict:
Susipicious
File Type:
PE
Link:
https://malprob.io/report/8ce3032c5fe1599125d89ac1f9a942e7f235b319054378d20021ed4ea73bfda4
Gathering data
Threat name:
Win64.Trojan.Znyonm
Create hunting rule
Status:
Malicious
First seen:
2025-03-18 11:02:16 UTC
File Type:
PE+ (Exe)
Extracted files:
3
AV detection:
12 of 24 (50.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=rtrqglc74fmzcjoytla7tkkc47zdlmyzavbxruqaehwu5jz37wsa._file
Verdict:
malicious
Label(s):
novastealer
Create hunting rule
Similar samples:
0d0c947d97036bcc46f7527e5a3953889c2ff2de32d503e463fbfa19d035716d
MassLogger
35bc7d58c116e83159e745ca536a9b5b0a1a4b4d25d0b8d462efd012b3c8ad21
MassLogger
38f73caeeb18b876e4ce3f07c3b0f3b6e145ae6ff1fc0f708448e40729a17861
MassLogger
3fd28257bdeaa92317003361ab95675732239e5282fde0ac2e2c7bf941ba1c98
MassLogger
5d3125c5df560d899a483b65d52860905b9e0d85daa29ea96327c02aa8f4cd87
MassLogger
error
MassLogger
+ 701 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
collection discovery
Link:
https://tria.ge/reports/250318-m4l76avjs6/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Executes dropped EXE
Loads dropped DLL
Verdict:
Suspicious
Tags:
404keylogger
YARA:
n/a
Link:
https://app.threat.zone/submission/34af8dde-6199-4818-914b-eb2957a9f7ff
Malware family:
PrivateLogger
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/8ce3032c5fe1/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8ce3032c5fe1599125d89ac1f9a942e7f235b319054378d20021ed4ea73bfda4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202409_html_FedEx_phish
Create hunting rule
Author:abuse.ch
Description:Detects potential HTML FedEx phishing forms
Rule name:APT_Bitter_ZxxZ_Downloader
Create hunting rule
Author:SECUINFRA Falcon Team (@SI_FalconTeam)
Description:Detects Bitter (T-APT-17) ZxxZ Downloader
Reference:https://www.secuinfra.com/en/techtalk/whatever-floats-your-boat-bitter-apt-continues-to-target-bangladesh
Rule name:attack_India
Create hunting rule
Rule name:BLOWFISH_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for Blowfish constants
Rule name:Check_OutputDebugStringA_iat
Create hunting rule
Rule name:crime_snake_keylogger
Create hunting rule
Author:Rony (r0ny_123)
Description:Detects Snake keylogger payload
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Glasses
Create hunting rule
Author:Seth Hardy
Description:Glasses family
Rule name:GlassesCode
Create hunting rule
Author:Seth Hardy
Description:Glasses code features
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_TelegramChatBot
Create hunting rule
Author:ditekSHen
Description:Detects executables using Telegram Chat Bot
Rule name:ldpreload
Create hunting rule
Author:xorseed
Reference:https://stuff.rop.io/
Rule name:MAL_Envrial_Jan18_1
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects Encrial credential stealer malware
Reference:https://twitter.com/malwrhunterteam/status/953313514629853184
Rule name:MAL_Envrial_Jan18_1_RID2D8C
Create hunting rule
Author:Florian Roth
Description:Detects Encrial credential stealer malware
Reference:https://twitter.com/malwrhunterteam/status/953313514629853184
Rule name:masslogger_gcch
Create hunting rule
Author:govcert_ch
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:Mimikatz_Generic
Create hunting rule
Author:Still
Description:attempts to match all variants of Mimikatz
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:reverse_http
Create hunting rule
Author:CD_R0M_
Description:Identify strings with http reversed (ptth)
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:SHA512_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA384/SHA512 constants
Rule name:skip20_sqllang_hook
Create hunting rule
Author:Mathieu Tartare <mathieu.tartare@eset.com>
Description:YARA rule to detect if a sqllang.dll version is targeted by skip-2.0. Each byte pattern corresponds to a function hooked by skip-2.0. If $1_0 or $1_1 match, it is probably targeted as it corresponds to the hook responsible for bypassing the authentication.
Reference:https://www.welivesecurity.com/
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
Rule name:telegram_bot_api
Create hunting rule
Author:rectifyq
Description:Detects file containing Telegram Bot API
Rule name:test_Malaysia
Create hunting rule
Author:rectifyq
Description:Detects file containing malaysia string
Rule name:upxHook
Create hunting rule
Author:@r3dbU7z
Description:Detect artifacts from 'upxHook' - modification of UPX packer
Reference:https://bazaar.abuse.ch/sample/6352be8aa5d8063673aa428c3807228c40505004320232a23d99ebd9ef48478a/
Rule name:vmdetect
Create hunting rule
Author:nex
Description:Possibly employs anti-virtualization techniques
Rule name:WHIRLPOOL_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for WhirlPool constants
Rule name:Windows_Trojan_SnakeKeylogger_af3faa65
Create hunting rule
Author:Elastic Security
Rule name:win_masslogger_w0
Create hunting rule
Author:govcert_ch
Rule name:without_attachments
Create hunting rule
Author:Antonio Sanchez <asanchez@hispasec.com>
Description:Rule to detect the no presence of any attachment
Reference:http://laboratorio.blogs.hispasec.com/
Rule name:with_urls
Create hunting rule
Author:Antonio Sanchez <asanchez@hispasec.com>
Description:Rule to detect the presence of an or several urls
Reference:http://laboratorio.blogs.hispasec.com/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

Executable exe 8ce3032c5fe1599125d89ac1f9a942e7f235b319054378d20021ed4ea73bfda4

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments