🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ad83577e425dfb5496897d25e3e4e7de8d7e100f4b0eacf1266eb9f12898fac8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 16


Intelligence 16 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ad83577e425dfb5496897d25e3e4e7de8d7e100f4b0eacf1266eb9f12898fac8
SHA3-384 hash: c544d3ae843dbdf563d5a0e79ec5b33b39e7686ce97249987f31081c2a1b9e6450486038e6651d5c40cb349ae4c36ec7
SHA1 hash: 1d20489cecae69d9610277939e2f7da0127a3839
MD5 hash: e8b2e93f0bdaa6e7a3f726555fd6d77d
humanhash: quiet-lima-white-mango
File name:ad83577e425dfb5496897d25e3e4e7de8d7e100f4b0eacf1266eb9f12898fac8
Download: download sample
Signature MassLogger
Create hunting rule
File size:988'160 bytes
First seen:2026-09-10 11:04:35 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'272 x AgentTesla, 20'616 x Formbook, 12'394 x SnakeKeylogger)
ssdeep 24576:bSZjP/2oSdvAg6wY6C2d6UG7UiJ5+J7PeR6BgTFUxAU:4b/2oSf9dE7bJ5+JW02FUG
TLSH T13625DF542256DC02D1E25AB4C8E0E2FF02745E87D412F2079AEA7D9F797A785FB842C3
TrID 73.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
6.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.6% (.EXE) Win64 Executable (generic) (6522/11/2)
4.5% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter adrian__luca
Tags:exe MassLogger

Intelligence

File Origin
# of uploads :
1
# of downloads :
110
Origin country :
HU HU
Vendor Threat Intelligence
Malware configuration found for:
NETReactor RoboSki
Details
Link:
https://research.acce.ciphertechsolutions.com/results/f6709cf2-ee5a-4277-befa-688ce00f9c4d/
Malware family:
n/a
ID:
1
File name:
exe
Verdict:
Malicious activity
Analysis date:
2026-09-10 13:37:29 UTC
Tags:
netreactor auto-reg stealer ip-check evasion smtp
Link:
https://app.any.run/tasks/66e0d8ad-b52a-41e2-881a-6c97eaefcd3e

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/84897/
Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6aca16532f93c5a044139909
Tags:
infosteal spam
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Сreating synchronization primitives
Creating a process with a hidden window
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Launching a process
Creating a file
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Forced shutdown of a system process
Adding an exclusion to Microsoft Defender
Unauthorized injection to a system process
Verdict:
Malicious
Labled as:
Genie8DN.Generic
Link:
https://www.hybrid-analysis.com/sample/ad83577e425dfb5496897d25e3e4e7de8d7e100f4b0eacf1266eb9f12898fac8
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-08-24T06:12:00Z UTC
Last seen:
2026-09-10T07:59:00Z UTC
Hits:
~1000
Link:
https://opentip.kaspersky.com/ad83577e425dfb5496897d25e3e4e7de8d7e100f4b0eacf1266eb9f12898fac8/results?tab=lookup
Malware family:
Snake Keylogger
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/a1740005-ac8f-4b3a-ae0f-c367d61c7961
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/ad83577e425dfb5496897d25e3e4e7de8d7e100f4b0eacf1266eb9f12898fac8
Verdict:
Malware
YARA:
12 match(es)
Tags:
.Net .Net Obfuscator .Net Reactor Executable Managed .NET PE (Portable Executable) PE File Layout SOS: 0.71 Win 32 Exe x86
Link:
https://app.malva.re/file/e8b2e93f0bdaa6e7a3f726555fd6d77d
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ad83577e425dfb5496897d25e3e4e7de8d7e100f4b0eacf1266eb9f12898fac8/
Threat name:
Win32.Trojan.Kepavll
Create hunting rule
Status:
Malicious
First seen:
2026-08-24 10:00:46 UTC
AV detection:
16 of 24 (66.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vwbvo7sclx5vjfujpus6hzhh32gx4eapjmhkz4jgn247ckey7lea._file
Result
Malware family:
masslogger
Create hunting rule
Score:
  10/10
Tags:
family:masslogger collection discovery execution persistence spyware stealer
Link:
https://tria.ge/reports/260910-m63mxsvzes/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Adds Run key to start application
Looks up external IP address via web service
Checks computer location settings
Executes dropped EXE
Command and Scripting Interpreter: PowerShell
Family: MassLogger
Unpacked files
SH256 hash:
ad83577e425dfb5496897d25e3e4e7de8d7e100f4b0eacf1266eb9f12898fac8
MD5 hash:
e8b2e93f0bdaa6e7a3f726555fd6d77d
SHA1 hash:
1d20489cecae69d9610277939e2f7da0127a3839
Link:
https://www.unpac.me/results/7b4f6890-819e-4da3-b0d2-e22cc250fe76/
SH256 hash:
948de98294621b9281b77cd8eb54a677aa0df9f9e9bda77844ab92524b182a03
MD5 hash:
157cb32a500d23b3f1a7bb6977629ba5
SHA1 hash:
0ce931496b554a3d235b7d8eeac47f431547bfe6
Link:
https://www.unpac.me/results/7b4f6890-819e-4da3-b0d2-e22cc250fe76/
SH256 hash:
eaf25dd110bc91ee5000644e517678981138ff9508e011600ace6351cdc83241
MD5 hash:
36eab044ee9af604f7e28e3a7ee0f525
SHA1 hash:
5bc0592f374a05b9e2233d194902b88791555cc6
Detections:
triage_snakekeylogger_infostealer
Create hunting rule
win_404keylogger_g1
Create hunting rule
win_masslogger_w0
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_TelegramChatBot
Create hunting rule
MAL_Envrial_Jan18_1
Create hunting rule
Link:
https://www.unpac.me/results/7b4f6890-819e-4da3-b0d2-e22cc250fe76/
Parent samples :
d9e876c0ef78f0d6087d0c41c8d47ebe9fc8137055c9d74bbb7c1fd7fb8e1fdf
01ad626abefeb19a1fd65ec27599b6cdc0d025dc42261317e77480860ffa7a09
4a1b87430fe4ad7a1e9a35d99f7c612e7f2d8dce339edd172753aee1632653cc
416c02fdc82b8d6456f1e08a796a2347d1ac04ac35dfa67c898e4802678ff60c
40ef805fbbf333e9a2c47bf8ca3832dd854829da0a31469ec5fd271348b6fab4
687587baff7f25ded9f03274277f12b6d6a347af2238c3b32defc2736bc7023b
301a9e3b24f14798ed32be5de3dd802b4c13edc182bc1e29f80a40a1dcc2425e
519de0a4ed8131067f6364e3ae9f010d962f897e50fbdc7479f1325947b68525
1ccf47d19e5181c626bf6ad2bad6e95051a3281e9234b3202906bbd8aadd79a4
9db47d46c9411cef28cb767455f523c0ed8bfdb9cb6a087b665fdab87d7741eb
9cbc97f1e626ea10a3f415d31ba5a6e499012c57c487c23c5b3c7603806bd687
ad83577e425dfb5496897d25e3e4e7de8d7e100f4b0eacf1266eb9f12898fac8
SH256 hash:
0e7d082c6ea72108d1f8b1269325fb937d70552d9c82409ec33b8b585f689544
MD5 hash:
72d85c1ed624d60dfdc6e86dd40ff52c
SHA1 hash:
e96194762794f73db5d88f36b389cb73ce96c849
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/7b4f6890-819e-4da3-b0d2-e22cc250fe76/
Malware family:
MassLogger
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/ad83577e425d/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ad83577e425dfb5496897d25e3e4e7de8d7e100f4b0eacf1266eb9f12898fac8

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/84897/

Comments