MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9d5c8e9c41ff08b0a3be489ac1ef0f014f2749ad0e3217af2e0665c514a072fc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 18


Intelligence 18 IOCs YARA 21 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9d5c8e9c41ff08b0a3be489ac1ef0f014f2749ad0e3217af2e0665c514a072fc
SHA3-384 hash: a80e13015a2d336dcf8dc265f5ab22b3511e0df4e49420e93822bdadf44a2997f0f29bab6938e10b4fa66b378e8987db
SHA1 hash: 363b4ef390cc8fc3d2082206515c7dd3e740b381
MD5 hash: 38951bb0b8f73de25014f4d9ef401286
humanhash: stream-violet-arizona-potato
File name:9d5c8e9c41ff08b0a3be489ac1ef0f014f2749ad0e3217af2e0665c514a072fc
Download: download sample
Signature MassLogger
Create hunting rule
File size:760'320 bytes
First seen:2025-10-09 14:03:40 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'003 x AgentTesla, 19'911 x Formbook, 12'332 x SnakeKeylogger)
ssdeep 12288:DPX9cu16sWg7q4Ob+pvcDkeckeV4X5IO/z5EF3O+NXoF+U+C9nsshEAEH:DP9wiqupOd9eVA3a14F+wsuEAE
TLSH T121F4020433AAEA02E5F28BF40831D7B407B87E4DB965E3065EE99DEF7835B419D41392
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10522/11/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter adrian__luca
Tags:exe MassLogger

Intelligence

File Origin
# of uploads :
1
# of downloads :
121
Origin country :
HU HU
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
9d5c8e9c41ff08b0a3be489ac1ef0f014f2749ad0e3217af2e0665c514a072fc.exe
Verdict:
Malicious activity
Analysis date:
2025-10-09 14:21:51 UTC
Tags:
evasion snake keylogger telegram stealer ims-api generic
Link:
https://app.any.run/tasks/59f1ed2c-468b-41ac-8984-a33c6e5997cc

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
VIPKeyLogger
Create hunting rule
Link:
https://www.capesandbox.com/analysis/31353/
Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68e7c1a07f305fa2545dfa76
Tags:
virus spawn msil
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Сreating synchronization primitives
Creating a process with a hidden window
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
DNS request
Connection attempt
Sending an HTTP GET request
Sending a custom TCP request
Reading critical registry keys
Stealing user critical data
Adding an exclusion to Microsoft Defender
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
obfuscated packed packed packer_detected vbnet
Link:
https://www.filescan.io/uploads/68e7c351c74bd2958b173cc3/reports/20e19b86-1aff-43cd-8b3e-67e73e782cbc/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/9d5c8e9c41ff08b0a3be489ac1ef0f014f2749ad0e3217af2e0665c514a072fc
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-09-18T03:38:00Z UTC
Last seen:
2025-10-10T05:51:00Z UTC
Hits:
~1000
Detections:
Trojan.MSIL.Crypt.sb HEUR:Trojan.MSIL.Taskun.gen VHO:Backdoor.Win32.Agent.gen Trojan-PSW.SnakeLogger.HTTP.C&C HEUR:Trojan-Spy.MSIL.Agent.sb PDM:Trojan.Win32.Generic Trojan-PSW.Win32.Stelega.sb Trojan-PSW.Win32.Stealer.sb Trojan.MSIL.Taskun.sb Trojan.MSIL.Inject.sb
Link:
https://opentip.kaspersky.com/9d5c8e9c41ff08b0a3be489ac1ef0f014f2749ad0e3217af2e0665c514a072fc/results?tab=lookup
Malware family:
Snake Keylogger
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/8011d052-4150-4a98-a925-64acf223bdfc
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/9d5c8e9c41ff08b0a3be489ac1ef0f014f2749ad0e3217af2e0665c514a072fc
Verdict:
inconclusive
YARA:
10 match(es)
Tags:
.Net Executable Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.44 Win 32 Exe x86
Link:
https://app.malva.re/file/38951bb0b8f73de25014f4d9ef401286
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9d5c8e9c41ff08b0a3be489ac1ef0f014f2749ad0e3217af2e0665c514a072fc/
Verdict:
Malicious
Threat:
Family.SNAKE
Link:
https://tip.neiki.dev/file/9d5c8e9c41ff08b0a3be489ac1ef0f014f2749ad0e3217af2e0665c514a072fc
Threat name:
ByteCode-MSIL.Trojan.VIPKeylogger
Create hunting rule
Status:
Malicious
First seen:
2025-09-18 10:49:48 UTC
File Type:
PE (.Net Exe)
Extracted files:
9
AV detection:
26 of 36 (72.22%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=tvoi5hcb74elbi56jcnmd3ypafhsosnnbyzbplzoazs4kffaol6a._file
Verdict:
malicious
Label(s):
vipkeylogger
Create hunting rule
unc_loader_078
Create hunting rule
unc_loader_037
Create hunting rule
Result
Malware family:
vipkeylogger
Create hunting rule
Score:
  10/10
Tags:
family:vipkeylogger collection discovery execution keylogger spyware stealer
Link:
https://tria.ge/reports/251009-rkc8cstyg1/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Browser Information Discovery
Enumerates physical storage devices
Program crash
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Checks computer location settings
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Command and Scripting Interpreter: PowerShell
VIPKeylogger
Vipkeylogger family
Malware Config
C2 Extraction:
https://api.telegram.org/bot8099843793:AAGeYKMLti1IpyT9o6bz7OtgdXF9md25uXA/sendMessage?chat_id=6337180137
Verdict:
Malicious
Tags:
404Keylogger
YARA:
n/a
Link:
https://app.threat.zone/submission/5e256bd6-52e6-4d46-bf67-56dc0be9626f
Unpacked files
SH256 hash:
9d5c8e9c41ff08b0a3be489ac1ef0f014f2749ad0e3217af2e0665c514a072fc
MD5 hash:
38951bb0b8f73de25014f4d9ef401286
SHA1 hash:
363b4ef390cc8fc3d2082206515c7dd3e740b381
Link:
https://www.unpac.me/results/f9b888d6-1bdd-4dd0-b501-ef0e0c61cd19/
SH256 hash:
3c855bbfae22eaccd00cb2947bf2f05fb733a99b4df7a767a7614be4086807e7
MD5 hash:
df945bc1cc642d673d52736f827cf6a4
SHA1 hash:
074684d7341a15208e584b6aa6cd8a6bc7d6cc99
Detections:
win_404keylogger_g1
Create hunting rule
win_masslogger_w0
Create hunting rule
MAL_Envrial_Jan18_1
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_DotNetProcHook
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_TelegramChatBot
Create hunting rule
Link:
https://www.unpac.me/results/f9b888d6-1bdd-4dd0-b501-ef0e0c61cd19/
Parent samples :
6ea116b59ac03c3211143de70e7ed3843d57a39b0c87936e58d1c5c8e17b439b
2b1709a9c749ff0e6bca3643813dd090ac492a20104666259f65939d5e0c40b0
9d5c8e9c41ff08b0a3be489ac1ef0f014f2749ad0e3217af2e0665c514a072fc
e463f87a0c098ff8bcbc4c262e9eddf3dea51148d2ba9d12c64addb21e2ff978
ccbdec866c4dc5272bf35d9e08186c71031cfc63d37e45d96a35d69cdfb5dfe6
3b80f1666e8725435546d010c6f775ec852dd7691618236563e1bed1043da625
733c3e1e510fe841346e63a3728ec2d195951ef1b70992ee1de55e42f353a10c
82e9f638f4235a110559bbb2e9d83c4f72c23040799c80fde7e9503cfe66aa6e
6a2cefdd2b5810aef5388f4b23392847ae4abe6d4142ea7145e0afd04c00fcab
SH256 hash:
1041b538ccbc7d66e59247ef7551cde9b6c282843541585e9190a8e2e3943b12
MD5 hash:
e870d1e8f3791ccc141f85f40fd2972b
SHA1 hash:
150919ee289cffa6feb40ab8261f620dd7e26aac
Link:
https://www.unpac.me/results/f9b888d6-1bdd-4dd0-b501-ef0e0c61cd19/
SH256 hash:
28c4d6f2a9a07d2ac420080d77ec671004a0fd0983ad5c832d3524971ff49e00
MD5 hash:
dc43eea419d7a8b4ed09229981ed311e
SHA1 hash:
d069fcb0b52ab2b2d1a7612c72f96161e0940b8d
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/f9b888d6-1bdd-4dd0-b501-ef0e0c61cd19/
Malware family:
SnakeKeylogger
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/9d5c8e9c41ff/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_AllMal_Detector
Create hunting rule
Author:DiegoAnalytics
Description:CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication
Rule name:crime_snake_keylogger
Create hunting rule
Author:Rony (r0ny_123)
Description:Detects Snake keylogger payload
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_DotNetProcHook
Create hunting rule
Author:ditekSHen
Description:Detects executables with potential process hoocking
Rule name:INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many email and collaboration clients. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_TelegramChatBot
Create hunting rule
Author:ditekSHen
Description:Detects executables using Telegram Chat Bot
Rule name:MAL_Envrial_Jan18_1
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects Encrial credential stealer malware
Reference:https://twitter.com/malwrhunterteam/status/953313514629853184
Rule name:MAL_Envrial_Jan18_1_RID2D8C
Create hunting rule
Author:Florian Roth
Description:Detects Encrial credential stealer malware
Reference:https://twitter.com/malwrhunterteam/status/953313514629853184
Rule name:masslogger_gcch
Create hunting rule
Author:govcert_ch
Rule name:matiex
Create hunting rule
Author:Michelle Khalil
Description:This rule detects unpacked matiex malware samples.
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:telegram_bot_api
Create hunting rule
Author:rectifyq
Description:Detects file containing Telegram Bot API
Rule name:Windows_Trojan_SnakeKeylogger_af3faa65
Create hunting rule
Author:Elastic Security
Rule name:win_masslogger_w0
Create hunting rule
Author:govcert_ch

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/31353/

Comments