MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bf73a2429c65f49ee778f1401c21a5ae4d655e6c17b61a6130fa024f54de1938. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

MassLogger

Vendor detections: 15

Intelligence 15 IOCs YARA 13 File information Comments

SHA256 hash:	bf73a2429c65f49ee778f1401c21a5ae4d655e6c17b61a6130fa024f54de1938
SHA3-384 hash:	0e22e35c3bd805b66e32b2032bb3b56c5f3556d5571fd988fe1f5cfc124a46046b9d423b1f8410f8ce53943bb5326445
SHA1 hash:	baab46ada1f8e249af98e1154ccc9bcaa205b4cf
MD5 hash:	949abdabb4ea66880f1ea134920e89ee
humanhash:	salami-blue-saturn-connecticut
File name:	SecuriteInfo.com.Trojan.Mardom.PN.11.17656.13789
Download:	download sample
Signature	MassLogger Create hunting rule
File size:	1'397'760 bytes
First seen:	2025-04-21 08:16:37 UTC
Last seen:	2025-04-21 08:16:42 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep	24576:w11L0nbbDSepthynYz2vlOkonYwOiq33EMIC+KUz9ymG4jr7PCFSzKEp2s0O8BDz:HSepLolOlniiq3HIdwmyF8L0O8BD48rf
Threatray	4'069 similar samples on MalwareBazaar
TLSH	T1385512816585CA55C1EE19388982F0345BB0ACBF6941EA6E72F93DFF32F6B43044616B
TrID	71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10522/11/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4504/4/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika	pebin
dhash icon	dcd4d4dcd4ece8dc (4 x AgentTesla, 4 x MassLogger, 1 x VIPKeylogger)
Reporter	SecuriteInfoCom
Tags:	exe MassLogger

Intelligence

File Origin

# of uploads :

# of downloads :

473

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

SecuriteInfo.com.Trojan.Mardom.PN.11.17656.13789

Verdict:

Malicious activity

Analysis date:

2025-04-21 08:18:35 UTC

Tags:

telegram snake keylogger evasion stealer ims-api generic

Link:

https://app.any.run/tasks/84f2c7f2-748c-4f22-beaf-35cfc003428f

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/3228/

Detection(s):

SecuriteInfo.com.Trojan.Mardom.PN.11.17656.13789.UNOFFICIAL

Verdict:

Malicious

Score:

81.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68060016280f5f89a0d2b529

Tags:

virus micro msil

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Launching a process

Сreating synchronization primitives

DNS request

Connection attempt

Sending an HTTP GET request

Sending a custom TCP request

Creating a window

Unauthorized injection to a system process

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

entropy obfuscated packed packed packer_detected

Link:

https://www.filescan.io/uploads/6805ff0989fec6b88b9fedf3/reports/1bbb67f7-5310-4818-9f09-a5e69f5aa08f/overview

Verdict:

Malicious

Labled as:

Trojan.Mardom.PN.Generic

Link:

https://www.hybrid-analysis.com/sample/bf73a2429c65f49ee778f1401c21a5ae4d655e6c17b61a6130fa024f54de1938

Malware family:

Snake Keylogger

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/f5360f96-3709-443b-9627-1c4eefc628c8

Result

Threat name:

MSIL Logger, MassLogger RAT

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1670204

Signature

.NET source code contains potential unpacker

Found malware configuration

Joe Sandbox ML detected suspicious sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Yara detected AntiVM3

Yara detected Costura Assembly Loader

Yara detected MassLogger RAT

Yara detected MSIL Logger

Behaviour

Behavior Graph:

Download SVG

Score:

99%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/bf73a2429c65f49ee778f1401c21a5ae4d655e6c17b61a6130fa024f54de1938

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/bf73a2429c65f49ee778f1401c21a5ae4d655e6c17b61a6130fa024f54de1938/

Threat name:

Win32.Spyware.Negasteal

Status:

Malicious

First seen:

2025-04-21 07:21:58 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

31 of 38 (81.58%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=x5z2equ4mx2j5z3y6fabyinfvzgwkxtmc63buyjq7ibe6vg6de4a._file

Verdict:

malicious

Label(s):

novastealer

MassLogger

8e63fcd9e5fcdd993a7535a3990f28a4c95740d801dbfde8fb0d338bbae22d4c

MassLogger

a448772fc396392ea06f8cc4276858096ca083104312b22369e7f6a95fb8d0b7

MassLogger

a6790d5442e968741a6031aa466a1c29397e291fa7fc6a26fca328fc48d95469

MassLogger

e6fe2241c57847a4911e325b6d3692839f9033de0c99ddeabd47e8d62022bcd1

MassLogger

+ 4'059 additional samples on MalwareBazaar

Result

Malware family:

masslogger

Score:

10/10

Tags:

family:masslogger collection discovery spyware stealer

Link:

https://tria.ge/reports/250421-j6thgayqy3/

Behaviour

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

MassLogger

Masslogger family

Malware Config

C2 Extraction:

https://api.telegram.org/bot7955681740:AAHZKZS-0PYft7OYGzJTk9fIEe7ig9DCvoA/sendMessage?chat_id=7355061733

Verdict:

Suspicious

Tags:

404keylogger

YARA:

n/a

Link:

https://app.threat.zone/submission/1fdd7b5c-717c-4c48-a41e-2ac08de9300e

Unpacked files

SH256 hash:

bf73a2429c65f49ee778f1401c21a5ae4d655e6c17b61a6130fa024f54de1938

MD5 hash:

949abdabb4ea66880f1ea134920e89ee

SHA1 hash:

baab46ada1f8e249af98e1154ccc9bcaa205b4cf

Link:

https://www.unpac.me/results/9fba6e3c-9e7e-4e56-bb8a-2cb89049cdfd/

SH256 hash:

0b915175e88908e4fb8d41c6c4bb019b63c78842a0520a2f8df27f3b1f3b3d1b

MD5 hash:

3353c4e1ea3526b9de96276100efeb63

SHA1 hash:

09cb91045ac04432af65cca749ebacbcbcf71d0d

Link:

https://www.unpac.me/results/9fba6e3c-9e7e-4e56-bb8a-2cb89049cdfd/

SH256 hash:

a7c9bdd5be1128c0707e27deaebd523559ce09ffde08ebf67d4d6cdbf223b0b0

MD5 hash:

84f634e02d667461c78f6037fa8d753f

SHA1 hash:

3540caecf17f6bd9d351621f4a450b8ccd39308d

Link:

https://www.unpac.me/results/9fba6e3c-9e7e-4e56-bb8a-2cb89049cdfd/

SH256 hash:

78f73e1734daa918b253517c75971fbb8df773a3d77d02a752e9a0ad1711a677

MD5 hash:

f9d2985aa1c41cca281321fffb5ed424

SHA1 hash:

3a7a58d2dcae2762882357ae34d372744b1dbb9d

Link:

https://www.unpac.me/results/9fba6e3c-9e7e-4e56-bb8a-2cb89049cdfd/

SH256 hash:

b4bd44584a27a9d7029c811b3ee8733feb1f55f0ecd6af4d90a79dcd6115bd7b

MD5 hash:

879877d3e9da7b05c143a4e8a0e16792

SHA1 hash:

768452ea94455389590f6649944ef1cffd9b6358

Detections:

win_404keylogger_g1

win_masslogger_w0

INDICATOR_SUSPICIOUS_EXE_TelegramChatBot

Link:

https://www.unpac.me/results/9fba6e3c-9e7e-4e56-bb8a-2cb89049cdfd/

Parent samples :

90c33f008fb667cf96ff92b14f8834e702e3f4444d195328c9be186e801e6823
8357f957b093fda087166e77b0e6a59d8d0d2fde1002d0be9ce5f99db26d63bb
abf8078644761623df4bdd4616a35a12990ae27825d9a32a85d49098e17dba56
45af78cb765e9ddd6500353d4d9dd4ef34babb350a3813710b671dc4a35aa1fb
c2b0e9ffba919397a65722465c861d5b8c1d35d536c3ecd0c9a3b0f8034884d2
e6fe2241c57847a4911e325b6d3692839f9033de0c99ddeabd47e8d62022bcd1
bf73a2429c65f49ee778f1401c21a5ae4d655e6c17b61a6130fa024f54de1938

SH256 hash:

5b8040aa8a3441a9fac732770a1aab8052bcd40401a023dff574d6387feb3935

MD5 hash:

992b54d342f9c3c96f762eaa083c749e

SHA1 hash:

c5bac5a29e0dfafda0af0e222f730e8b9dabfd97

Link:

https://www.unpac.me/results/9fba6e3c-9e7e-4e56-bb8a-2cb89049cdfd/

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	crime_snake_keylogger Create hunting rule
Author:	Rony (r0ny_123)
Description:	Detects Snake keylogger payload

Rule name:	INDICATOR_SUSPICIOUS_EXE_TelegramChatBot Create hunting rule
Author:	ditekSHen
Description:	Detects executables using Telegram Chat Bot

Rule name:	masslogger_gcch Create hunting rule
Author:	govcert_ch

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

Rule name:	telegram_bot_api Create hunting rule
Author:	rectifyq
Description:	Detects file containing Telegram Bot API

Rule name:	Windows_Trojan_SnakeKeylogger_af3faa65 Create hunting rule
Author:	Elastic Security

Rule name:	win_masslogger_w0 Create hunting rule
Author:	govcert_ch

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/3228/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (GUARD_CF)	high

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample