MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ad39ce838d5675f72507af938244271c015e66005fecffa8323843d374fa5efd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 15


Intelligence 15 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ad39ce838d5675f72507af938244271c015e66005fecffa8323843d374fa5efd
SHA3-384 hash: 924a1f390e017bff59bd820b83bd79937e20a91ef8308ecfea25463eec27b067d95a73c70bda0cc0ad5e20fb7081c722
SHA1 hash: 9d6b9ad72ad8cdca023f7e6303034c9864df0bf2
MD5 hash: f0415e027ddd30d4d4ac690e5ca4e06f
humanhash: magnesium-twenty-texas-quiet
File name:swift.exe
Download: download sample
Signature MassLogger
Create hunting rule
File size:544'768 bytes
First seen:2025-04-08 13:34:56 UTC
Last seen:2025-04-14 13:10:57 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'474 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:v5bLORFkieKuUz/W5uTAWdWvGwAahFRfSKE85tb:v5BdCO5u9dWGhahFlSKEON
Threatray 1 similar samples on MalwareBazaar
TLSH T184C4E15833D69A15D0AA0BF89AB1C2B44334BD9D5926D30B6FD93CEF397BB009815393
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10522/11/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter lowmal3
Tags:exe MassLogger

Intelligence

File Origin
# of uploads :
3
# of downloads :
460
Origin country :
DE DE
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
swift.exe
Verdict:
Malicious activity
Analysis date:
2025-04-08 19:29:19 UTC
Tags:
snake keylogger evasion stealer netreactor ims-api generic
Link:
https://app.any.run/tasks/02e9bd40-7a38-4fe4-83fc-164f1aeefbe3

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Verdict:
Malicious
Score:
90.2%
Link:
https://cyber-fortress.com/docs/result/index.php?id=67f52716e011fe619fad7d17
Tags:
backdoor botnet hype
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file
Сreating synchronization primitives
DNS request
Connection attempt
Sending an HTTP GET request
Sending a custom TCP request
Reading critical registry keys
Creating a window
Unauthorized injection to a recently created process
Restart of the analyzed sample
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed packed packer_detected
Link:
https://www.filescan.io/uploads/67f526132d430c849e0d187a/reports/51e1279f-20c4-4858-8c2f-9492fc6102ec/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/ad39ce838d5675f72507af938244271c015e66005fecffa8323843d374fa5efd
Malware family:
Snake Keylogger
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/9b766493-ea23-4d76-bd94-78a17b2ba7f7
Result
Threat name:
MSIL Logger, MassLogger RAT
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1659510
Signature
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
Contains functionality to log keystrokes (.Net Source)
Found malware configuration
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Tries to detect the country of the analysis system (by using the IP)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected AntiVM3
Yara detected MassLogger RAT
Yara detected MSIL Logger
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/ad39ce838d5675f72507af938244271c015e66005fecffa8323843d374fa5efd
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ad39ce838d5675f72507af938244271c015e66005fecffa8323843d374fa5efd/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2025-04-08 11:20:44 UTC
File Type:
PE (.Net Exe)
Extracted files:
5
AV detection:
27 of 38 (71.05%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vu445a4nkz27ojihv6jyerbhdqav4zqal7wp7kbshbb5g5h2l36q._file
Verdict:
malicious
Label(s):
captiveaaloader
Create hunting rule
unc_loader_037
Create hunting rule
novastealer
Create hunting rule
Similar samples:
error
MassLogger
Result
Malware family:
n/a
Score:
  7/10
Tags:
collection discovery spyware stealer
Link:
https://tria.ge/reports/250408-qvvpqavtgw/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Verdict:
Malicious
Tags:
404keylogger
YARA:
n/a
Link:
https://app.threat.zone/submission/a4e11364-feac-4148-befb-84c59b4e04df
Unpacked files
SH256 hash:
ad39ce838d5675f72507af938244271c015e66005fecffa8323843d374fa5efd
MD5 hash:
f0415e027ddd30d4d4ac690e5ca4e06f
SHA1 hash:
9d6b9ad72ad8cdca023f7e6303034c9864df0bf2
Link:
https://www.unpac.me/results/93fd1164-619d-4b57-ae8d-73d8455a656f/
SH256 hash:
a19791bac14a75b376c7274cf37944eaa07b02d2ee638657317dea00cbeee49d
MD5 hash:
2317e3917f786e5841813f2cf4304a36
SHA1 hash:
1bb2dec899dfddef8f9030381eda26250455d91b
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/93fd1164-619d-4b57-ae8d-73d8455a656f/
SH256 hash:
ce62f1296214ce2d3095c9691cc5e58a88145b430964974cd9871e0628c28285
MD5 hash:
09d6bdc81689962264c4eaaabfe3e7b2
SHA1 hash:
383cc4bc6a6b992f196bccb28f10b621719c582b
Link:
https://www.unpac.me/results/93fd1164-619d-4b57-ae8d-73d8455a656f/
SH256 hash:
b13b374da798371dafe66d50b29266e5fe42f40737cb5d54b7d2ef2b3b01cf73
MD5 hash:
220c0f0e3aef0910ed2c170ef5afa52e
SHA1 hash:
f0e0e616618ddea182482c50e65fc010a73c5b84
Detections:
win_404keylogger_g1
Create hunting rule
win_masslogger_w0
Create hunting rule
MAL_Envrial_Jan18_1
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_TelegramChatBot
Create hunting rule
Link:
https://www.unpac.me/results/93fd1164-619d-4b57-ae8d-73d8455a656f/
Parent samples :
69399f96737f87f2fed08cc2f632fe6099a09e53e453beb8a04bf652d76cf021
3273a94d52018736cda72d20b5a1d187479d4a6f41a178d27ca12a21ad922f07
f87239bd174493d2b3d1e570a97c945d50ce01b7e4a2b122822b7ef9fc79acac
a391bb999d34e0e74fe05c157756e1d40d083a84f7c78f822fc0c42a44f99dae
9eee28cce69f0cecb50e56a5816b04ec51bce18c0ec622f855d1298b8c5c0fdb
ad39ce838d5675f72507af938244271c015e66005fecffa8323843d374fa5efd
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ad39ce838d5675f72507af938244271c015e66005fecffa8323843d374fa5efd

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

Executable exe ad39ce838d5675f72507af938244271c015e66005fecffa8323843d374fa5efd

(this sample)

  
Delivery method
Distributed via e-mail attachment

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments