MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a5bb9c91c3a99564b48eb8d9a9ff1ec5de3084c15224d49bf71c0a7a0eddcd18. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 14


Intelligence 14 IOCs YARA 44 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a5bb9c91c3a99564b48eb8d9a9ff1ec5de3084c15224d49bf71c0a7a0eddcd18
SHA3-384 hash: 81149eba3d6fcd605cb8ea9059ffb61e077f0e6aee8adedbffa0c1eb41bbfc246f839bdcb3852b4071188e4f5b8cb983
SHA1 hash: 1b61a4874fc933ba3d786a1f9d06a0ed3ada3a6d
MD5 hash: 40852c298ccaa1cdcbc2b48c0f4e3e55
humanhash: mexico-summer-montana-nitrogen
File name:a5bb9c91c3a99564b48eb8d9a9ff1ec5de3084c15224d49bf71c0a7a0eddcd18
Download: download sample
Signature MassLogger
Create hunting rule
File size:1'383'424 bytes
First seen:2026-05-28 11:56:04 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'006 x AgentTesla, 19'914 x Formbook, 12'332 x SnakeKeylogger)
ssdeep 24576:KfedLZCfxbIRxJzck+uGW/yFoBkkAxg2jJv4VDZzAT:KfeLZVRTYjqqanRaJvaD
Threatray 163 similar samples on MalwareBazaar
TLSH T10555BF5273F84216E1FF5B76A8B2481487B3F4669A36DB4F098461ED1EB3780DE10B63
TrID 63.0% (.RLL) Microsoft Resource Library (x86) (177572/6/26)
25.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
2.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
2.3% (.EXE) Win64 Executable (generic) (6522/11/2)
1.7% (.EXE) Win16 NE executable (generic) (5038/12/1)
Magika pebin
Reporter JAMESWT_WT
Tags:exe gitlab-com--Hoangdepzaivcl MassLogger

Intelligence

File Origin
# of uploads :
1
# of downloads :
85
Origin country :
IT IT
Vendor Threat Intelligence
Malware configuration found for:
QuasarRAT
Details
Link:
https://research.acce.ciphertechsolutions.com/results/a5158bbb-b177-43b9-b880-6eacfb9b3d9c/
Malware family:
n/a
ID:
1
File name:
_a5bb9c91c3a99564b48eb8d9a9ff1ec5de3084c15224d49bf71c0a7a0eddcd18.exe
Verdict:
Malicious activity
Analysis date:
2026-05-28 11:59:33 UTC
Tags:
stealer pulsar rat
Link:
https://app.any.run/tasks/20a97ebf-5514-466a-b763-4814db99b63c

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/68284/
Detection(s):
Win.Malware.Generic-9883083-0
Create hunting rule

Win.Malware.Bulz-9933026-0
Create hunting rule

Win.Packed.Msilperseus-9956592-0
Create hunting rule

Win.Malware.Generic-6623004-0
Create hunting rule

YARA.RUSSIANPANDA_Win_Mal_Chromium_App_Bound_Encryption_Decrypter.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a182d72c73fda38a80a62da
Tags:
vmdetect emotet
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Сreating synchronization primitives
Connection attempt
Verdict:
Malicious
Labled as:
Win/malicious_confidence_70%
Link:
https://www.hybrid-analysis.com/sample/a5bb9c91c3a99564b48eb8d9a9ff1ec5de3084c15224d49bf71c0a7a0eddcd18
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-05-28T09:14:00Z UTC
Last seen:
2026-05-30T03:23:00Z UTC
Hits:
~10
Detections:
HEUR:Trojan-Banker.MSIL.ClipBanker.gen Trojan.MSIL.Agent.sb Trojan-PSW.MSIL.Stealer.sb Trojan-GameThief.MSIL.Worgtop.b HEUR:Trojan.MSIL.Agent.d HEUR:Trojan-PSW.Win32.Agent.sb HEUR:Trojan-PSW.MSIL.Stealer.gen Backdoor.MSIL.PulsarRAT.sb Trojan-PSW.Win32.Coins.sb Trojan-PSW.MSIL.Agent.sb Trojan-GameThief.MSIL.Worgtop.a HEUR:Trojan.Win32.Generic HEUR:Trojan.MSIL.Agent.c HEUR:Trojan.MSIL.Agent.b
Link:
https://opentip.kaspersky.com/a5bb9c91c3a99564b48eb8d9a9ff1ec5de3084c15224d49bf71c0a7a0eddcd18/results?tab=lookup
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/6be54a69-ce54-4fac-b7ec-120a504160eb
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/a5bb9c91c3a99564b48eb8d9a9ff1ec5de3084c15224d49bf71c0a7a0eddcd18
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a5bb9c91c3a99564b48eb8d9a9ff1ec5de3084c15224d49bf71c0a7a0eddcd18/
Verdict:
Malicious
Threat:
Family.PULSARRAT
Link:
https://tip.neiki.dev/file/a5bb9c91c3a99564b48eb8d9a9ff1ec5de3084c15224d49bf71c0a7a0eddcd18
Threat name:
ByteCode-MSIL.Trojan.MassLogger
Create hunting rule
Status:
Malicious
First seen:
2026-05-28 11:55:44 UTC
File Type:
PE (.Net Exe)
Extracted files:
6
AV detection:
21 of 24 (87.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=uw5zzeodvgkwjneoxdm2t7y6yxpdbbgbkisnjg7xdqfhudw5zuma._file
Verdict:
malicious
Label(s):
xoriumstealer
Create hunting rule
quasarrat
Create hunting rule
Similar samples:
20e41f9151518c16eaaec357c16761d4dfebabb425ac727105a10020b34e169e
MassLogger
7a24023adcb3ea06c47f23d97a301b348b9067f50c2229ad770a390c7ca76cdd
MassLogger
94682a961e8a61b5a4b34e689de98f0a89b5e8c75bdfc493ed796c29a6b03536
MassLogger
ca687401049c4fae9fc3d278008361f470f79dcdc20fda5e9e4c482d2a9c7df7
MassLogger
daff6666d05db409cb72e822bb115f14bfa703547292ee228dad3e5c8f19e041
MassLogger
error
MassLogger
+ 153 additional samples on MalwareBazaar
Result
Malware family:
xorium_stealer
Create hunting rule
Score:
  10/10
Tags:
family:quasar family:xorium_stealer spyware stealer trojan
Link:
https://tria.ge/reports/260528-n4apsset5k/
Behaviour
Suspicious behavior: AddClipboardFormatListener
Suspicious use of AdjustPrivilegeToken
Detects XoriumStealer payload
Family: Quasar RAT
Family: XoriumStealer
Quasar payload
Unpacked files
SH256 hash:
a5bb9c91c3a99564b48eb8d9a9ff1ec5de3084c15224d49bf71c0a7a0eddcd18
MD5 hash:
40852c298ccaa1cdcbc2b48c0f4e3e55
SHA1 hash:
1b61a4874fc933ba3d786a1f9d06a0ed3ada3a6d
Detections:
win_masslogger_w0
Create hunting rule
QuasarRAT
Create hunting rule
Link:
https://www.unpac.me/results/4273d7b7-c06d-42ef-971e-432c9e9640f9/
SH256 hash:
3d742d35f86c0c54ed7872f7da422abb5dc1101e5e5448555ee2dd514848cf7b
MD5 hash:
3d2a214b773830711e93809d8277b468
SHA1 hash:
42d4c4ffdd534056f98e995c70d4f7a0d59d7446
Detections:
triage_cobaltstrike_reflective
Create hunting rule
Link:
https://www.unpac.me/results/4273d7b7-c06d-42ef-971e-432c9e9640f9/
Parent samples :
daff6666d05db409cb72e822bb115f14bfa703547292ee228dad3e5c8f19e041
94682a961e8a61b5a4b34e689de98f0a89b5e8c75bdfc493ed796c29a6b03536
ca687401049c4fae9fc3d278008361f470f79dcdc20fda5e9e4c482d2a9c7df7
a5bb9c91c3a99564b48eb8d9a9ff1ec5de3084c15224d49bf71c0a7a0eddcd18
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BLOWFISH_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for Blowfish constants
Rule name:Check_Dlls
Create hunting rule
Rule name:Check_VBox_Guest_Additions
Create hunting rule
Rule name:Check_VmTools
Create hunting rule
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerHiding__Thread
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:Detect_PowerShell_Obfuscation
Create hunting rule
Author:daniyyell
Description:Detects obfuscated PowerShell commands commonly used in malicious scripts.
Rule name:detect_Redline_Stealer_V2
Create hunting rule
Author:Varp0s
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:grakate_stealer_nov_2021
Create hunting rule
Rule name:hunting_generic_win_rat
Create hunting rule
Author:Ajin Deepak, AD2001
Description:Hunting RATS based on common patterns
Rule name:INDICATOR_EXE_Packed_Fody
Create hunting rule
Author:ditekSHen
Description:Detects executables manipulated with Fody
Rule name:Indicator_MiniDumpWriteDump
Create hunting rule
Author:Obscurity Labs LLC
Description:Detects PE files and PowerShell scripts that use MiniDumpWriteDump either through direct imports or string references
Rule name:INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
Create hunting rule
Author:ditekSHen
Description:Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
Create hunting rule
Author:ditekSHen
Description:Detects Windows executables referencing non-Windows User-Agents
Rule name:INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many email and collaboration clients. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many file transfer clients. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
Create hunting rule
Author:ditekSHen
Description:Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
Rule name:Lumma_Stealer_Detection
Create hunting rule
Author:ashizZz
Description:Detects a specific Lumma Stealer malware sample using unique strings and behaviors
Reference:https://seanthegeek.net/posts/compromized-store-spread-lumma-stealer-using-fake-captcha/
Rule name:Macos_Infostealer_Wallets_8e469ea0
Create hunting rule
Author:Elastic Security
Rule name:MAL_BackNet_Nov18_1
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects BackNet samples
Reference:https://github.com/valsov/BackNet
Rule name:MAL_BackNet_Nov18_1_RID2D6D
Create hunting rule
Author:Florian Roth
Description:Detects BackNet samples
Reference:https://github.com/valsov/BackNet
Rule name:masslogger_gcch
Create hunting rule
Author:govcert_ch
Rule name:Multifamily_RAT_Detection
Create hunting rule
Author:Lucas Acha (http://www.lukeacha.com)
Description:Generic Detection for multiple RAT families, PUPs, Packers and suspicious executables
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:Njrat
Create hunting rule
Author:botherder https://github.com/botherder
Description:Njrat
Rule name:pe_imphash
Create hunting rule
Rule name:Pulsar_RAT
Create hunting rule
Author:@bartblaze
Description:Identifies Pulsar RAT, based on Quasar RAT.
Reference:https://malpedia.caad.fkie.fraunhofer.de/details/win.pulsar_rat
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:ReflectiveLoader
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects a unspecified hack tool, crack or malware using a reflective loader - no hard match - further investigation recommended
Reference:Internal Research
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:telebot_framework
Create hunting rule
Author:vietdx.mb
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.
Rule name:vmdetect
Create hunting rule
Author:nex
Description:Possibly employs anti-virtualization techniques
Rule name:win_masslogger_w0
Create hunting rule
Author:govcert_ch

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/68284/

Comments