MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 9dee1f01f62ac121f05da0afd753e25ff3e832d5c75b516b8d8fef92b675d209. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
MassLogger
Vendor detections: 15
| SHA256 hash: | 9dee1f01f62ac121f05da0afd753e25ff3e832d5c75b516b8d8fef92b675d209 |
|---|---|
| SHA3-384 hash: | 2deefc534b43b0c5aac2593246df99acbbd628beb70fd173f18ad679935f021d271e53c294b527fcfed1a9b5d51fbdda |
| SHA1 hash: | f02559ceb149c72ec1638dc0dacf252c2b936ebd |
| MD5 hash: | 28184d3d643aa611dda323b40261306b |
| humanhash: | fruit-nine-harry-island |
| File name: | SecuriteInfo.com.Trojan.Inject5.25835.22695.12487 |
| Download: | download sample |
| Signature | MassLogger |
| File size: | 1'245'696 bytes |
| First seen: | 2026-04-15 09:35:45 UTC |
| Last seen: | 2026-04-15 10:30:23 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (49'003 x AgentTesla, 19'910 x Formbook, 12'332 x SnakeKeylogger) |
| ssdeep | 24576:2yYm852b89TTgPR74fTI/9m/eS+6imBBqtqVSic:uN52b8G7UIjSimXqvj |
| Threatray | 4'155 similar samples on MalwareBazaar |
| TLSH | T1554502522654C2DBD25C5538C0B792781175CEBA27E7CD0AEECE3F675630B4E2E6C828 |
| TrID | 72.4% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 6.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 6.4% (.EXE) Win64 Executable (generic) (6522/11/2) 4.4% (.EXE) Win32 Executable (generic) (4504/4/1) 2.0% (.EXE) Win16/32 Executable Delphi generic (2072/23) |
| Magika | pebin |
| dhash icon | 9881848a0a6ce198 (1 x MassLogger) |
| Reporter |  SecuriteInfoCom |
| Tags: | exe MassLogger |
Intelligence
File Origin
# of uploads :
2
# of downloads :
116
Origin country :
FRVendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
SecuriteInfo.com.Trojan.Inject5.25835.22695.12487
Verdict:
Malicious activity
Analysis date:
2026-04-15 09:37:50 UTC
Tags:
evasion snake keylogger stealer auto-startup smtp netreactor
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Verdict:
Malicious
Score:
94.9%
Tags:
autorun spam
Result
Verdict:
Malware
Maliciousness:
Behaviour
DNS request
Connection attempt
Sending an HTTP GET request
Sending a custom TCP request
Launching a process
Creating a process with a hidden window
Reading critical registry keys
Searching for synchronization primitives
Creating a window
Creating a file in the %temp% directory
Creating a process from a recently created file
Creating a file in the %AppData% directory
Сreating synchronization primitives
Unauthorized injection to a recently created process
Stealing user critical data
Setting a global event handler for the keyboard
Enabling autorun by creating a file
Unauthorized injection to a system process
Gathering data
Verdict:
Malicious
Labled as:
IL:Trojan.MSILZilla
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-06-26T05:09:00Z UTC
Last seen:
2026-04-16T07:03:00Z UTC
Hits:
~100
Detections:
Trojan.MSIL.Agent.sb Trojan-PSW.Win32.Stelega.sb Trojan-Spy.Agent.SMTP.C&C HEUR:Trojan.MSIL.Agent.gen Trojan.MSIL.Inject.sb Trojan-Spy.MSIL.BPLogger.sb Trojan-PSW.MSIL.Agent.sb HEUR:Trojan-PSW.MSIL.Stealer.gen Trojan.MSIL.Dnoper.sb HEUR:Trojan.Win32.Generic HEUR:Trojan-Spy.MSIL.Agent.sb Trojan.Win32.Agent.sb Trojan-PSW.Win32.Stealer.sb Trojan-PSW.MSIL.PureLogs.sb HEUR:Trojan-PSW.MSIL.PureLogs.gen Trojan.MSIL.DOTHETUK.sb PDM:Trojan.Win32.Generic Trojan.MSIL.Agent.sba
Malware family:
Snake Keylogger
Verdict:
Malicious
Score:
100%
Verdict:
Malware
File Type:
PE
Gathering data
Verdict:
Malicious
Threat:
Family.SNAKE
Threat name:
ByteCode-MSIL.Trojan.PureLogStealer
Status:
Malicious
First seen:
2025-06-03 00:58:00 UTC
File Type:
PE (.Net Exe)
Extracted files:
38
AV detection:
26 of 38 (68.42%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Label(s):
novastealer
Similar samples:
+ 4'145 additional samples on MalwareBazaar
Result
Malware family:
masslogger
Score:
10/10
Tags:
family:masslogger collection discovery spyware stealer
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Checks computer location settings
Drops startup file
Executes dropped EXE
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Family: MassLogger
Unpacked files
SH256 hash:
9dee1f01f62ac121f05da0afd753e25ff3e832d5c75b516b8d8fef92b675d209
MD5 hash:
28184d3d643aa611dda323b40261306b
SHA1 hash:
f02559ceb149c72ec1638dc0dacf252c2b936ebd
SH256 hash:
ce9fcb90cca06ba5b377ef0db4d61596b138e466bf6626cede0359651d5c3515
MD5 hash:
5db4c121d556b15266e62ae4356a50c2
SHA1 hash:
084289d48449ca10a7cc56f3736523f2e0c54f12
Detections:
SUSP_OBF_NET_Reactor_Indicators_Jan24
SH256 hash:
78f73e1734daa918b253517c75971fbb8df773a3d77d02a752e9a0ad1711a677
MD5 hash:
f9d2985aa1c41cca281321fffb5ed424
SHA1 hash:
3a7a58d2dcae2762882357ae34d372744b1dbb9d
SH256 hash:
19efdf03cb94895935225795f68bb9abfded1869687367013b8b4eee3cc99372
MD5 hash:
4e29f75c0c51b9dec76955f0382d9541
SHA1 hash:
4899aa8e3f57339cbaec8faab777897a76fe1c3a
SH256 hash:
cc9e200e5afc679ca55a0e327c4d979f170f31c1de4296110a8bf321f0c01ca7
MD5 hash:
6e03a31c0cc2c7e400f78ace3d7c28ac
SHA1 hash:
83ed9d61e21e9db02c6017c9dfbddce655057291
Detections:
win_404keylogger_g1
win_masslogger_w0
MAL_Envrial_Jan18_1
INDICATOR_SUSPICIOUS_Binary_References_Browsers
INDICATOR_SUSPICIOUS_EXE_TelegramChatBot
SH256 hash:
ab098286da43e7bff349ba508196edfa97ffbcf80ed33de4455f82288595a240
MD5 hash:
2a0461fe19b10bf85d643f604ccac385
SHA1 hash:
c486e2f0e2c8217c996f5c9511030fd52f1d5b08
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | CP_Script_Inject_Detector |
|---|---|
| Author: | DiegoAnalytics |
| Description: | Detects attempts to inject code into another process across PE, ELF, Mach-O binaries |
| Rule name: | Lumma_Stealer_Detection |
|---|---|
| Author: | ashizZz |
| Description: | Detects a specific Lumma Stealer malware sample using unique strings and behaviors |
| Reference: | https://seanthegeek.net/posts/compromized-store-spread-lumma-stealer-using-fake-captcha/ |
| Rule name: | masslogger_gcch |
|---|---|
| Author: | govcert_ch |
| Rule name: | MD5_Constants |
|---|---|
| Author: | phoul (@phoul) |
| Description: | Look for MD5 constants |
| Rule name: | NET |
|---|---|
| Author: | malware-lu |
| Rule name: | NETexecutableMicrosoft |
|---|---|
| Author: | malware-lu |
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
| Rule name: | Sus_CMD_Powershell_Usage |
|---|---|
| Author: | XiAnzheng |
| Description: | May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP) |
| Rule name: | VECT_Ransomware |
|---|---|
| Author: | Mustafa Bakhit |
| Description: | Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments. |
| Rule name: | win_masslogger_w0 |
|---|---|
| Author: | govcert_ch |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.