MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 b8fe102219ac498f855d823704eba0e2973547d2ce5abaf5b91eb0f84d57e21c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
MassLogger
Vendor detections: 16
| SHA256 hash: | b8fe102219ac498f855d823704eba0e2973547d2ce5abaf5b91eb0f84d57e21c |
|---|---|
| SHA3-384 hash: | 56b299df565f5de3c78e1e1b1db3c713c46ff8dc633b0d70e1666e68b09e9e64c8d0f2db02f6038c2b2ee420ce6c478b |
| SHA1 hash: | c95bb0f251c99ccef10ee848fb7ddd53b897dbd6 |
| MD5 hash: | 1688a1608ccb7b197642723f15271e00 |
| humanhash: | april-saturn-vermont-asparagus |
| File name: | 3ud41m0ni4.exe |
| Download: | download sample |
| Signature | MassLogger |
| File size: | 916'995 bytes |
| First seen: | 2025-11-08 12:12:52 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'748 x AgentTesla, 19'651 x Formbook, 12'246 x SnakeKeylogger) |
| ssdeep | 24576:9gBB5pSQG72r8ANMNFz3jFHOkwozzLMpHOS+g1tJpNMUS4XbotP9oWKsuCSF0NZ8:yX |
| Threatray | 10 similar samples on MalwareBazaar |
| TLSH | T1CA15AB18ED80DA8AD519F937C9F5B210C77675835363D22F593A9DBA21C23278C8E4BC |
| TrID | 67.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 9.7% (.EXE) Win64 Executable (generic) (10522/11/4) 6.0% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 4.1% (.EXE) Win32 Executable (generic) (4504/4/1) |
| Magika | pebin |
| Reporter |  NDA0E |
| Tags: | exe MassLogger PXRECVOWEIWOEI |
Intelligence
File Origin
# of uploads :
1
# of downloads :
147
Origin country :
USVendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
_b8fe102219ac498f855d823704eba0e2973547d2ce5abaf5b91eb0f84d57e21c.exe
Verdict:
Malicious activity
Analysis date:
2025-11-08 12:15:52 UTC
Tags:
evasion stealer wmi-base64 ims-api generic telegram
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Verdict:
Malicious
Score:
99.1%
Tags:
virus sage smtp
Result
Verdict:
Malware
Maliciousness:
Behaviour
Сreating synchronization primitives
Using the Windows Management Instrumentation requests
Running batch commands
DNS request
Launching a process
Connection attempt
Creating a window
Sending an HTTP GET request
Creating a file in the %temp% subdirectories
Creating a file
Reading critical registry keys
Launching the process to change network settings
Searching for synchronization primitives
Stealing user critical data
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
base64 hacktool obfuscated overlay reconnaissance
Verdict:
Malicious
Labled as:
Trojan.Mardom.MN.Generic
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-11-06T19:13:00Z UTC
Last seen:
2025-11-08T22:09:00Z UTC
Hits:
~100
Detections:
Trojan-PSW.Win32.Agent.sb Trojan-PSW.MSIL.Stealer.sb Trojan-PSW.MSIL.Discord.sb PDM:Trojan.Win32.Generic Trojan-PSW.Win32.Stealer.sb Trojan-PSW.Win32.Disco.sb Trojan-PSW.Win32.Coins.sb Trojan-Downloader.MSIL.Seraph.b Trojan.Win32.Agent.sb HEUR:Trojan-PSW.MSIL.Coins.gen not-a-virus:PSWTool.MSIL.BroPass.sb
Verdict:
Unknown
Score:
98%
Verdict:
Malware
File Type:
PE
Gathering data
Verdict:
Malicious
Threat:
Family.OBJ3CTIVITY
Threat name:
ByteCode-MSIL.Trojan.Mardom
Status:
Malicious
First seen:
2025-11-06 17:25:04 UTC
File Type:
PE (.Net Exe)
Extracted files:
2
AV detection:
27 of 38 (71.05%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
0bj3ctivitystealer
Similar samples:
Result
Malware family:
obj3ctivity
Score:
10/10
Tags:
family:obj3ctivity collection discovery persistence privilege_escalation spyware stealer
Behaviour
Checks processor information in registry
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Browser Information Discovery
Event Triggered Execution: Netsh Helper DLL
System Network Configuration Discovery: Wi-Fi Discovery
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Reads user/profile data of web browsers
Detects Obj3ctivity Stage1
Obj3ctivity family
Obj3ctivity, PXRECVOWEIWOEI
Verdict:
Malicious
Tags:
External_IP_Lookup
YARA:
n/a
Unpacked files
SH256 hash:
b8fe102219ac498f855d823704eba0e2973547d2ce5abaf5b91eb0f84d57e21c
MD5 hash:
1688a1608ccb7b197642723f15271e00
SHA1 hash:
c95bb0f251c99ccef10ee848fb7ddd53b897dbd6
Detections:
win_masslogger_w0
SH256 hash:
bc22897883ca792160092c9493d5dc32fbddbec910ccaba492b5c1f08a0f3923
MD5 hash:
8a8f64f11cfa169ff0ee0f317d50c402
SHA1 hash:
4ad40ff7b57f1667afe53d3167aeb732d2dd9842
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | DebuggerCheck__RemoteAPI |
|---|---|
| Reference: | https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara |
| Rule name: | DetectEncryptedVariants |
|---|---|
| Author: | Zinyth |
| Description: | Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded |
| Rule name: | grakate_stealer_nov_2021 |
|---|
| Rule name: | masslogger_gcch |
|---|---|
| Author: | govcert_ch |
| Rule name: | NET |
|---|---|
| Author: | malware-lu |
| Rule name: | NETexecutableMicrosoft |
|---|---|
| Author: | malware-lu |
| Rule name: | pe_imphash |
|---|
| Rule name: | RANSOMWARE |
|---|---|
| Author: | ToroGuitar |
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
| Rule name: | Sus_CMD_Powershell_Usage |
|---|---|
| Author: | XiAnzheng |
| Description: | May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP) |
| Rule name: | win_masslogger_w0 |
|---|---|
| Author: | govcert_ch |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.