MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 932857e7d796c0ea5002d21a2f6fe9646fc1de0548c2847d6dfe0458dc1398cc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

MassLogger

Vendor detections: 16

Intelligence 16 IOCs YARA 22 File information Comments

SHA256 hash:	932857e7d796c0ea5002d21a2f6fe9646fc1de0548c2847d6dfe0458dc1398cc
SHA3-384 hash:	ab0b0a2ebb4a6d380a6ec3653ba946b9ca157415da06bb3d4ce2fda586380ff66a22291a606e25b865d37cc3e9b1ad53
SHA1 hash:	f8c8584f1830c8c1b72802d6e656a59ff19c7691
MD5 hash:	18ef0c50b7342b6faae615f5d1132367
humanhash:	hydrogen-grey-apart-glucose
File name:	Orde#r077301.bat
Download:	download sample
Signature	MassLogger Create hunting rule
File size:	562'184 bytes
First seen:	2025-08-26 09:12:28 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep	12288:oDZOFACgkhbq6uD9/zWR5r/Yk7xAmrocVmhan2mm7RCkR:oNmACgkNqJ97WEk70v
Threatray	625 similar samples on MalwareBazaar
TLSH	T18AC4E19C3110B15FC493DA3249A4DE74D7756CAAA307C313A6EB2CAF7E0D6D69E041E2
TrID	71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10522/11/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4504/4/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika	pebin
Reporter	adrian__luca
Tags:	exe MassLogger

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

Orde#r077301.bat

Verdict:

Malicious activity

Analysis date:

2025-08-26 09:29:45 UTC

Tags:

evasion netreactor auto-sch-xml snake keylogger stealer ims-api generic

Link:

https://app.any.run/tasks/bf702ed6-7dcb-4a48-b786-6329050c1bb1

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/23622/

Detection(s):

SecuriteInfo.com.Trojan.Clipper.617.8177.16172.UNOFFICIAL

Verdict:

Malicious

Score:

96.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68ad7ac8eb163e0ec182bb84

Tags:

micro spawn shell spam

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Sending a custom TCP request

Creating a file in the %AppData% directory

Enabling the 'hidden' option for recently created files

Adding an access-denied ACE

Creating a process with a hidden window

Creating a file in the %temp% directory

Launching a process

Unauthorized injection to a recently created process

Restart of the analyzed sample

Creating a file

Сreating synchronization primitives

DNS request

Connection attempt

Sending an HTTP GET request

Reading critical registry keys

Stealing user critical data

Adding an exclusion to Microsoft Defender

Enabling autorun by creating a file

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

invalid-signature obfuscated obfuscated obfuscated packed packed packer_detected remcos signed vbnet

Link:

https://www.filescan.io/uploads/68ad7b2e253799db621bb679/reports/903298b6-e112-4b67-b406-0418712706d4/overview

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/932857e7d796c0ea5002d21a2f6fe9646fc1de0548c2847d6dfe0458dc1398cc

Verdict:

Malicious

File Type:

exe x32

First seen:

2025-08-21T02:14:00Z UTC

Last seen:

2025-08-21T02:14:00Z UTC

Hits:

~1000

Link:

https://opentip.kaspersky.com/932857e7d796c0ea5002d21a2f6fe9646fc1de0548c2847d6dfe0458dc1398cc/results?tab=lookup

Malware family:

Snake Keylogger

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/3ea343eb-aba9-4465-95db-00f87ab8142d

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/932857e7d796c0ea5002d21a2f6fe9646fc1de0548c2847d6dfe0458dc1398cc

Verdict:

inconclusive

YARA:

12 match(es)

Tags:

.Net Executable Managed .NET PE (Portable Executable) PE File Layout SOS: 0.78 Win 32 Exe x86

Link:

https://app.malva.re/file/18ef0c50b7342b6faae615f5d1132367

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/932857e7d796c0ea5002d21a2f6fe9646fc1de0548c2847d6dfe0458dc1398cc/

Threat name:

Win32.Packed.Generic

Status:

Suspicious

First seen:

2025-08-21 07:33:00 UTC

AV detection:

19 of 24 (79.17%)

Threat level:

1/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=smufpz6xs3aouuac2inc637jmrx4dxqfjdbii7ln7ycfrxattdga._file

Verdict:

malicious

Label(s):

unc_loader_037

MassLogger

14fc010bba506071a73611d32fd83f0cb181f0ed6d7675f736000c7cd2c4b6cf

MassLogger

4156831dff69a42b6dfd9725ed18b812d9f3933e77d54f7f87b52b785054c9a0

MassLogger

afafe9eb66c81266d5fc9353912a06f148afc49324605da77250642c9358afa2

MassLogger

+ 615 additional samples on MalwareBazaar

Result

Malware family:

masslogger

Score:

10/10

Tags:

family:masslogger collection defense_evasion discovery execution persistence spyware stealer

Link:

https://tria.ge/reports/250826-k74khaw1bt/

Behaviour

Scheduled Task/Job: Scheduled Task

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Checks computer location settings

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Command and Scripting Interpreter: PowerShell

Modifies trusted root certificate store through registry

MassLogger

Masslogger family

Malware Config

C2 Extraction:

https://api.telegram.org/bot8249574412:AAEYI1aKTMsQBYXH4o8C5XnXqiv65jV2kC8/sendMessage?chat_id=6488172735

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/96633aff-89f7-4857-976b-13d4fa976b35

Unpacked files

SH256 hash:

932857e7d796c0ea5002d21a2f6fe9646fc1de0548c2847d6dfe0458dc1398cc

MD5 hash:

18ef0c50b7342b6faae615f5d1132367

SHA1 hash:

f8c8584f1830c8c1b72802d6e656a59ff19c7691

Link:

https://www.unpac.me/results/3f6b7a4a-5ea5-43b7-a6a6-694a36853c1e/

SH256 hash:

27e5ffda53751e7360f380bd82a3176a7875a555f6af5b130fb2d64ff776c895

MD5 hash:

68845a1d0f6c65bb7ecc09ca76d2f005

SHA1 hash:

0145c4314c2cf41ae583bb32784fe780c1cdaf1d

Link:

https://www.unpac.me/results/3f6b7a4a-5ea5-43b7-a6a6-694a36853c1e/

SH256 hash:

c9405ddf057b051d9d9c9247f07cd8afadd6ba84b85c867af01d50a975cc1fd7

MD5 hash:

b3e77a5cb11517175b2330003fc7cb7f

SHA1 hash:

88c711c54dec56376a7945f935b9548ff01337a2

Detections:

win_404keylogger_g1

win_masslogger_w0

MAL_Envrial_Jan18_1

INDICATOR_SUSPICIOUS_Binary_References_Browsers

INDICATOR_SUSPICIOUS_EXE_TelegramChatBot

Link:

https://www.unpac.me/results/3f6b7a4a-5ea5-43b7-a6a6-694a36853c1e/

Parent samples :

58ea06e2f9f4c8108e1803ca0869805eae62c5f9f0651e6b53e66a0aafb3c349
329bd5c046cbf67eb31dd230e0d888374afbee19d89f333ffbe41494079dbdfd
3052b8ccdf8f2b0e43ff460d0fa79e75fe741fcbb823fce9ba5d7db8203d0c3a
3a120eebc11796c039efb1e6d45ad79505b09527fcfc580ccbd3550c2b4a2382
66513d2b0ca211cd190997156119713b7b8704a49a28fb9a8328749b9dc2cd45
932857e7d796c0ea5002d21a2f6fe9646fc1de0548c2847d6dfe0458dc1398cc
f9c86d1815b169a952352073adc608b0e215e9bfb871cd85e59a76d1152aff14
e054c2fc74e0788e698df9e69fed9d8fe975df61fe699281508e4a097e43c8d2
5240a9ff514c4c31fa548a21ef76f684efb7b62edb0b2db9cc5fbaa00e73b87b
007cd810db2b95805793f8b38d89946479092c54385a4e127bb9dfe5512ade1c

SH256 hash:

2810fae95e8395c8b232e9c38b14e8ab54db5e9cbf2d33c9c49f547cd6eb7f2b

MD5 hash:

5511173a51d367cd011f98246e9f3165

SHA1 hash:

e7b7000eb74ae703c567af5d8e917a754e32f14b

Detections:

SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24

SUSP_OBF_NET_Reactor_Indicators_Jan24

Link:

https://www.unpac.me/results/3f6b7a4a-5ea5-43b7-a6a6-694a36853c1e/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/932857e7d796c0ea5002d21a2f6fe9646fc1de0548c2847d6dfe0458dc1398cc

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	attack_India Create hunting rule

Rule name:	CP_AllMal_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication

Rule name:	crime_snake_keylogger Create hunting rule
Author:	Rony (r0ny_123)
Description:	Detects Snake keylogger payload

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	INDICATOR_KB_CERT_7c1118cbbadc95da3752c46e47a27438 Create hunting rule
Author:	ditekSHen
Description:	Detects executables signed with stolen, revoked or invalid certificates

Rule name:	INDICATOR_SUSPICIOUS_Binary_References_Browsers Create hunting rule
Author:	ditekSHen
Description:	Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Rule name:	INDICATOR_SUSPICIOUS_EXE_TelegramChatBot Create hunting rule
Author:	ditekSHen
Description:	Detects executables using Telegram Chat Bot

Rule name:	MAL_Envrial_Jan18_1 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects Encrial credential stealer malware
Reference:	https://twitter.com/malwrhunterteam/status/953313514629853184

Rule name:	MAL_Envrial_Jan18_1_RID2D8C Create hunting rule
Author:	Florian Roth
Description:	Detects Encrial credential stealer malware
Reference:	https://twitter.com/malwrhunterteam/status/953313514629853184

Rule name:	masslogger_gcch Create hunting rule
Author:	govcert_ch

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	pe_imphash Create hunting rule

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

Rule name:	telegram_bot_api Create hunting rule
Author:	rectifyq
Description:	Detects file containing Telegram Bot API

Rule name:	Windows_Trojan_SnakeKeylogger_af3faa65 Create hunting rule
Author:	Elastic Security

Rule name:	win_masslogger_w0 Create hunting rule
Author:	govcert_ch

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

exe 932857e7d796c0ea5002d21a2f6fe9646fc1de0548c2847d6dfe0458dc1398cc

(this sample)

Delivery method

Distributed via e-mail attachment

Cape

https://www.capesandbox.com/analysis/23622/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample