MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9d7b4e0c952ec93d8798c98b0ba00a07af4ba72cb1f98c27f08529069edcdc33. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 15


Intelligence 15 IOCs YARA 16 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9d7b4e0c952ec93d8798c98b0ba00a07af4ba72cb1f98c27f08529069edcdc33
SHA3-384 hash: 551aafd52db390bbaaba9fddf4acbbc24d6afc168ebcf34c111809199bdb7edde60f2c658f4037e6231c31ff71978515
SHA1 hash: bf937f7e660fd4ac185b5b57ab0842c2ce51c546
MD5 hash: d613b513361d6ee2ee1bd147804175ea
humanhash: venus-xray-mirror-winter
File name:9d7b4e0c952ec93d8798c98b0ba00a07af4ba72cb1f98c27f08529069edcdc33
Download: download sample
Signature MassLogger
Create hunting rule
File size:643'584 bytes
First seen:2025-04-08 08:33:46 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'474 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:3k1G0S5g7YWm/nqEyWZzTyqzzGVL8YAN4km3KbayOW2oD58q4abnqz:4NShiEFTyqzTYANmlRovh
Threatray 20 similar samples on MalwareBazaar
TLSH T1CAD4F12EBE66D925CB5C0E37C443D08846B5E14AF116F3F991CD2DE54EB3A20C88F95A
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10522/11/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
dhash icon 16e8c8e8e8c8e812 (10 x SnakeKeylogger, 9 x Formbook, 6 x MassLogger)
Reporter adrian__luca
Tags:exe MassLogger

Intelligence

File Origin
# of uploads :
1
# of downloads :
326
Origin country :
HU HU
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SWIFT MESAJI.exe
Verdict:
Malicious activity
Analysis date:
2025-03-26 09:05:10 UTC
Tags:
snake keylogger evasion stealer ims-api generic
Link:
https://app.any.run/tasks/09c7fa76-3c9c-437c-836a-ce598f310a8f

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=67f4e1b3e011fe619fad24fc
Tags:
virus spawn msil
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Сreating synchronization primitives
Creating a process with a hidden window
Creating a file in the %temp% directory
Launching a process
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
DNS request
Connection attempt
Sending an HTTP GET request
Sending a custom TCP request
Reading critical registry keys
Adding an exclusion to Microsoft Defender
Enabling autorun by creating a file
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
obfuscated obfuscated packed packed packer_detected vbnet
Link:
https://www.filescan.io/uploads/67f4df87eb7eb0aee0426829/reports/47b82151-277f-4cb8-a660-62268e37575c/overview
Verdict:
Malicious
Labled as:
Trojan.GenericS
Link:
https://www.hybrid-analysis.com/sample/9d7b4e0c952ec93d8798c98b0ba00a07af4ba72cb1f98c27f08529069edcdc33
Malware family:
KeyBase
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/b6881eb5-5043-417b-9225-060608e38330
Result
Threat name:
MSIL Logger, MassLogger RAT
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1659571
Signature
.NET source code contains potential unpacker
.NET source code contains very large array initializations
.NET source code references suspicious native API functions
Adds a directory exclusion to Windows Defender
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Contains functionality to log keystrokes (.Net Source)
Found malware configuration
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Loading BitLocker PowerShell Module
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Scheduled temp file as task from temp location
Tries to detect the country of the analysis system (by using the IP)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AntiVM3
Yara detected MassLogger RAT
Yara detected MSIL Logger
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1659571 Sample: xEfiHyM2zU.exe Startdate: 08/04/2025 Architecture: WINDOWS Score: 100 48 reallyfreegeoip.org 2->48 50 checkip.dyndns.org 2->50 52 checkip.dyndns.com 2->52 54 Found malware configuration 2->54 56 Malicious sample detected (through community Yara rule) 2->56 58 Antivirus / Scanner detection for submitted sample 2->58 62 12 other signatures 2->62 8 xEfiHyM2zU.exe 7 2->8         started        12 dsEXHmXPcuJ.exe 5 2->12         started        signatures3 60 Tries to detect the country of the analysis system (by using the IP) 48->60 process4 file5 36 C:\Users\user\AppData\...\dsEXHmXPcuJ.exe, PE32 8->36 dropped 38 C:\Users\...\dsEXHmXPcuJ.exe:Zone.Identifier, ASCII 8->38 dropped 40 C:\Users\user\AppData\Local\...\tmp9A77.tmp, XML 8->40 dropped 42 C:\Users\user\AppData\...\xEfiHyM2zU.exe.log, ASCII 8->42 dropped 64 Uses schtasks.exe or at.exe to add and modify task schedules 8->64 66 Adds a directory exclusion to Windows Defender 8->66 68 Injects a PE file into a foreign processes 8->68 14 powershell.exe 23 8->14         started        17 xEfiHyM2zU.exe 15 2 8->17         started        20 schtasks.exe 1 8->20         started        22 xEfiHyM2zU.exe 8->22         started        70 Antivirus detection for dropped file 12->70 72 Multi AV Scanner detection for dropped file 12->72 24 dsEXHmXPcuJ.exe 14 2 12->24         started        26 schtasks.exe 1 12->26         started        signatures6 process7 dnsIp8 74 Loading BitLocker PowerShell Module 14->74 28 conhost.exe 14->28         started        30 WmiPrvSE.exe 14->30         started        44 checkip.dyndns.com 193.122.6.168, 49687, 49689, 80 ORACLE-BMC-31898US United States 17->44 46 reallyfreegeoip.org 104.21.96.1, 443, 49688, 49690 CLOUDFLARENETUS United States 17->46 32 conhost.exe 20->32         started        76 Tries to steal Mail credentials (via file / registry access) 24->76 78 Tries to harvest and steal browser information (history, passwords, etc) 24->78 34 conhost.exe 26->34         started        signatures9 process10
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/9d7b4e0c952ec93d8798c98b0ba00a07af4ba72cb1f98c27f08529069edcdc33
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9d7b4e0c952ec93d8798c98b0ba00a07af4ba72cb1f98c27f08529069edcdc33/
Threat name:
Win32.Trojan.CrypterX
Create hunting rule
Status:
Malicious
First seen:
2025-03-26 09:32:50 UTC
File Type:
PE (.Net Exe)
Extracted files:
1
AV detection:
19 of 24 (79.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=tv5u4devf3et3b4yzgfqxiaka6xuxjzmwh4yyj7qquuqnhw43qzq._file
Verdict:
malicious
Label(s):
unc_loader_037
Create hunting rule
novastealer
Create hunting rule
Similar samples:
1081e4e28ab35a70584e49c4a5dbd783b02c9380e797c5e542d93f5ebbda9ab5
MassLogger
1a98a78c6e63e52bd77d0a49c4738646e60c86e077174e523383509d2701f0e6
MassLogger
c307a1875ba19a6e5a8127d23aec14b6e1661fae50a09e92ac971dd77e2e3341
MassLogger
efa962fc10045f83da36ea363c43aba7a8d5ff3ec0e3aaa4c6480c2578b8c4fa
MassLogger
fd8e7b62caa0d61d214b44a53bebfb372c92b7153ef05b7a554604f1221a5beb
MassLogger
+ 10 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
collection discovery execution spyware stealer
Link:
https://tria.ge/reports/250408-kgajqsssbs/
Behaviour
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Checks computer location settings
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Command and Scripting Interpreter: PowerShell
Verdict:
Malicious
Tags:
404keylogger
YARA:
n/a
Link:
https://app.threat.zone/submission/99a3ec09-96a5-478a-853a-2406c63e6dbf
Unpacked files
SH256 hash:
9d7b4e0c952ec93d8798c98b0ba00a07af4ba72cb1f98c27f08529069edcdc33
MD5 hash:
d613b513361d6ee2ee1bd147804175ea
SHA1 hash:
bf937f7e660fd4ac185b5b57ab0842c2ce51c546
Link:
https://www.unpac.me/results/aba6658b-cb7e-42de-b6eb-0750dd09ab2e/
SH256 hash:
32a435a4610ffd79eb16810db7016917f65f91376ec0a4cf2cd32e817a1a07c6
MD5 hash:
e290670df236c9ee2b66e9bd63ed9921
SHA1 hash:
6916a972bd0faeae38804932954c8cf04a3dd04d
Detections:
win_404keylogger_g1
Create hunting rule
win_masslogger_w0
Create hunting rule
MAL_Envrial_Jan18_1
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_TelegramChatBot
Create hunting rule
Link:
https://www.unpac.me/results/aba6658b-cb7e-42de-b6eb-0750dd09ab2e/
Parent samples :
e9819076355cb8f2c7534fbf14155e74376fcb291c879d8bc2e0d28bd973c122
293a0c10be849644ec095d7e436a50df007d2bdd13be2af96092dc0ba35f940c
5f637f363eda5c68b90daf33b41e46f22f955527ad67863bbb48fd7d3ec12ee8
106092b32c6933ddeb96acd2e8c1206cb864c1a6b1c15e92adb38d5562f1dc72
857e8d8504bc34fe0ce3d503d277106f7b577436e512fc3d98b5a83248bf037d
dfe95338ebb2364cb5d0634be41347a65d7988497e8348ccfbc41d03b373f88d
9d7b4e0c952ec93d8798c98b0ba00a07af4ba72cb1f98c27f08529069edcdc33
SH256 hash:
30f15e975e26b63428a88a0974530cfd15c78e800491a1229d856d3a9e9bc242
MD5 hash:
9729b793d90a2171b6325668ea46e0a8
SHA1 hash:
9c035b97e10785213b80e5bfa7216e131b6318d4
Link:
https://www.unpac.me/results/aba6658b-cb7e-42de-b6eb-0750dd09ab2e/
SH256 hash:
1b37ef6f4508276514299784dd59686d0dce2360f8846665a1f851545c543798
MD5 hash:
615a01f628a7b4a5650b1df065a2bd31
SHA1 hash:
df791381de707aafe839e2dfa386e48e2ffe7a33
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/aba6658b-cb7e-42de-b6eb-0750dd09ab2e/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9d7b4e0c952ec93d8798c98b0ba00a07af4ba72cb1f98c27f08529069edcdc33

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:crime_snake_keylogger
Create hunting rule
Author:Rony (r0ny_123)
Description:Detects Snake keylogger payload
Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_TelegramChatBot
Create hunting rule
Author:ditekSHen
Description:Detects executables using Telegram Chat Bot
Rule name:MAL_Envrial_Jan18_1
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects Encrial credential stealer malware
Reference:https://twitter.com/malwrhunterteam/status/953313514629853184
Rule name:MAL_Envrial_Jan18_1_RID2D8C
Create hunting rule
Author:Florian Roth
Description:Detects Encrial credential stealer malware
Reference:https://twitter.com/malwrhunterteam/status/953313514629853184
Rule name:masslogger_gcch
Create hunting rule
Author:govcert_ch
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
Rule name:telegram_bot_api
Create hunting rule
Author:rectifyq
Description:Detects file containing Telegram Bot API
Rule name:Windows_Trojan_SnakeKeylogger_af3faa65
Create hunting rule
Author:Elastic Security
Rule name:win_masslogger_w0
Create hunting rule
Author:govcert_ch

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments