MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9d67042ccd43e9389b4b6c717f7407dd26fa5edd3689896d3fe6a52d8534a780. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 12


Intelligence 12 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9d67042ccd43e9389b4b6c717f7407dd26fa5edd3689896d3fe6a52d8534a780
SHA3-384 hash: 9f1cb916424b5d3286683fb09f00ea5b563e5e7c612bdf37619f7f5dcaedc4feab7b79680b70c68503f765368267b375
SHA1 hash: 0e3246ef02c972a57c437306bb59111dae78d4dd
MD5 hash: 8da8d7479ec26e410fa8d2e953a39ab4
humanhash: mississippi-burger-alpha-sink
File name:9d67042ccd43e9389b4b6c717f7407dd26fa5edd3689896d3fe6a52d8534a780
Download: download sample
Signature MassLogger
Create hunting rule
File size:543'232 bytes
First seen:2025-07-07 15:18:29 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:SjbDBcr0mQNscg2c11wm62Vi4wjilAKEJAMxA:SjbDI0m1B1JgSlAKE+MxA
Threatray 3'792 similar samples on MalwareBazaar
TLSH T1FEC4F145D5538E16D0AB0BBD2BAAC17A2A321FCE942AC70F9FC63DE775733411585B02
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10522/11/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
dhash icon a8cccc949494b4d4 (6 x SnakeKeylogger, 5 x AgentTesla, 2 x Formbook)
Reporter adrian__luca
Tags:exe MassLogger

Intelligence

File Origin
# of uploads :
1
# of downloads :
23
Origin country :
HU HU
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/13301/
Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=686be57ec9eb9747376777d2
Tags:
spawn shell msil
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Creating a process with a hidden window
Creating a file in the %temp% directory
Launching a process
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Сreating synchronization primitives
DNS request
Connection attempt
Adding an exclusion to Microsoft Defender
Enabling autorun by creating a file
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/9d67042ccd43e9389b4b6c717f7407dd26fa5edd3689896d3fe6a52d8534a780
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/9d67042ccd43e9389b4b6c717f7407dd26fa5edd3689896d3fe6a52d8534a780
Verdict:
inconclusive
YARA:
10 match(es)
Tags:
.Net Executable PDB Path PE (Portable Executable) SOS: 0.02 Win 32 Exe x86
Link:
https://app.malva.re/file/8da8d7479ec26e410fa8d2e953a39ab4
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9d67042ccd43e9389b4b6c717f7407dd26fa5edd3689896d3fe6a52d8534a780/
Threat name:
Win32.Packed.Generic
Create hunting rule
Status:
Suspicious
First seen:
2025-06-27 07:34:55 UTC
File Type:
PE (.Net Exe)
Extracted files:
11
AV detection:
19 of 24 (79.17%)
Threat level:
  1/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=tvtqilgniputrg2lnryx65ah3utpuxw5g2eys3j742ss3bjuu6aa._file
Verdict:
malicious
Label(s):
novastealer
Create hunting rule
unc_loader_037
Create hunting rule
Similar samples:
776e675ee48e029e417d5ed22ef53ccb5225660871d2152c4f4dc786eff91e62
MassLogger
9d67042ccd43e9389b4b6c717f7407dd26fa5edd3689896d3fe6a52d8534a780
MassLogger
aba0672f82dcf1487d5b7b5647291ee0974e962018425dbc48ee10438fd6cf07
MassLogger
e9dcf2288b4adbbfe01de0f952df0f050ef533fa151e77b786ceee577f51a079
MassLogger
error
MassLogger
f10dcedfa178a0bce77e909b072ff0deb66ab588db90b7f5eb3d0bbe8c75215b
MassLogger
+ 3'782 additional samples on MalwareBazaar
Result
Malware family:
masslogger
Create hunting rule
Score:
  10/10
Tags:
family:masslogger collection discovery execution persistence spyware stealer
Link:
https://tria.ge/reports/250707-sqdxhswxb1/
Behaviour
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Checks computer location settings
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Command and Scripting Interpreter: PowerShell
MassLogger
Masslogger family
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/83d35d91-7240-4a67-b053-354b554f2e6a
Unpacked files
SH256 hash:
9d67042ccd43e9389b4b6c717f7407dd26fa5edd3689896d3fe6a52d8534a780
MD5 hash:
8da8d7479ec26e410fa8d2e953a39ab4
SHA1 hash:
0e3246ef02c972a57c437306bb59111dae78d4dd
Link:
https://www.unpac.me/results/390d8dde-ba43-4894-a200-816215cd2146/
SH256 hash:
fd8e694ab19875cb7fd6d4230f4a9385ec7b1f83fd7c1c98bc874df20c94b0ac
MD5 hash:
f311ad1781cb9620986213d7e39b9e5b
SHA1 hash:
29e4da2327b6f9644f3b394d6933e0ee122edf4e
Link:
https://www.unpac.me/results/390d8dde-ba43-4894-a200-816215cd2146/
SH256 hash:
adccbc4d43cd92446275d5fa1525791f73477d02f33b64dbe760bf99621468ea
MD5 hash:
99569c05a39351903eb8a872ce7b2ea7
SHA1 hash:
46c41784e465bbbe9755c43a1bd1ce846506db0b
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/390d8dde-ba43-4894-a200-816215cd2146/
SH256 hash:
baeb0c28f054433986f63d2a9db722b5c0bee8a44fb4d03d2ebbea9827221efe
MD5 hash:
d0ce726175f3292183d0bb0f329b7265
SHA1 hash:
603bf3b2988a998ddcb6d94ef4225609ece0f8e8
Detections:
win_404keylogger_g1
Create hunting rule
win_masslogger_w0
Create hunting rule
MAL_Envrial_Jan18_1
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_TelegramChatBot
Create hunting rule
Link:
https://www.unpac.me/results/390d8dde-ba43-4894-a200-816215cd2146/
Parent samples :
ff686f645ff7a1b0672895a7a72a5ee528cd112b2469182c79c98f7621af607e
4d7ae4a600ffeadb38636c294d14612029a0b76313fefb6f27b606b2018b3400
efd86329975988f4c9e3178d139e82558d9ab07bb53dea0c5b6d0b234bb5cd35
c470eab16e537bf777506e63bbedd58114c0403965e9a01965507ffd731dde4d
784f9e5d1eedc785401f6397aab1d9fbfff7593262f8db591e50ae06d37cba02
01e140fe679c25634196075a34eb5c8594ec3631571023282955962b3dc1f609
02430eed2a0da0347c2b28a864ca61a55a79a925f4fbcdccb2806f2030c2ec4e
7e33af8622230cc26f8600ea1ff34bb8f38ed9c5124909961357b3a81ed03ce8
54a8b4c753e22ebf0f248088c4424393f31417b9d79e0dafe7bf573e6263240a
f10dcedfa178a0bce77e909b072ff0deb66ab588db90b7f5eb3d0bbe8c75215b
9d67042ccd43e9389b4b6c717f7407dd26fa5edd3689896d3fe6a52d8534a780
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9d67042ccd43e9389b4b6c717f7407dd26fa5edd3689896d3fe6a52d8534a780

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/13301/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments