MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c307a1875ba19a6e5a8127d23aec14b6e1661fae50a09e92ac971dd77e2e3341. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

MassLogger

Vendor detections: 15

Intelligence 15 IOCs YARA 7 File information Comments

SHA256 hash:	c307a1875ba19a6e5a8127d23aec14b6e1661fae50a09e92ac971dd77e2e3341
SHA3-384 hash:	a23de87bdb54c5d4b4451c100293a07aaa4c6fdc763990b85c177f9374e5e2b45797cef6d193ba65f8949ef5b3290a09
SHA1 hash:	e5529cd1247b815bb78b98577508ba62dede6d73
MD5 hash:	c0adda26e0c007e3f0cc07e1fa959e47
humanhash:	vermont-harry-skylark-stairway
File name:	c307a1875ba19a6e5a8127d23aec14b6e1661fae50a09e92ac971dd77e2e3341
Download:	download sample
Signature	MassLogger Create hunting rule
File size:	590'856 bytes
First seen:	2025-04-08 08:14:54 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'602 x Formbook, 12'241 x SnakeKeylogger)
ssdeep	12288:rE614DuTaDZTX3o1dSrT2f/L+syfA+XlpgXsjJiRIqtOTFkR:2a+xrT2fj+sqAIlpPjQiY7
Threatray	1'494 similar samples on MalwareBazaar
TLSH	T1D8C4121FB2106956CE4C1B358193694D49F19617ACB3F27C18D848DBAFFBB0841DADCA
TrID	69.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.0% (.EXE) Win64 Executable (generic) (10522/11/4) 6.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.2% (.EXE) Win32 Executable (generic) (4504/4/1) 1.9% (.EXE) Win16/32 Executable Delphi generic (2072/23)
Magika	pebin
dhash icon	14f0ccced6cce971 (11 x SnakeKeylogger, 9 x Formbook, 5 x MassLogger)
Reporter	adrian__luca
Tags:	exe MassLogger

Intelligence

File Origin

# of uploads :

# of downloads :

352

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

c307a1875ba19a6e5a8127d23aec14b6e1661fae50a09e92ac971dd77e2e3341

Verdict:

Malicious activity

Analysis date:

2025-04-08 10:36:36 UTC

Tags:

snake keylogger evasion stealer ims-api generic

Link:

https://app.any.run/tasks/38b170c0-3f6c-48cc-82cb-53868d45ef5f

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

SecuriteInfo.com.Win32.MalwareX-gen.25861.30938.UNOFFICIAL

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67f4dcb2a695a0cd1facab86

Tags:

virus spawn shell

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Сreating synchronization primitives

Creating a process with a hidden window

Unauthorized injection to a recently created process

Restart of the analyzed sample

Creating a file

DNS request

Connection attempt

Sending an HTTP GET request

Sending a custom TCP request

Reading critical registry keys

Adding an exclusion to Microsoft Defender

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

expired-cert invalid-signature obfuscated obfuscated packed packed packer_detected signed

Link:

https://www.filescan.io/uploads/67f4db1b2d430c849e0c7467/reports/049ced32-76cb-4f3b-8e6c-9c3552d131e8/overview

Verdict:

Malicious

Labled as:

Jalapeno.Generic

Link:

https://www.hybrid-analysis.com/sample/c307a1875ba19a6e5a8127d23aec14b6e1661fae50a09e92ac971dd77e2e3341

Malware family:

Snake Keylogger

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/cbf9ba61-02ab-4c7f-8562-34d6f3d0c8cb

Result

Threat name:

MSIL Logger, MassLogger RAT

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1659888

Signature

.NET source code contains potential unpacker

.NET source code contains very large array initializations

.NET source code references suspicious native API functions

Adds a directory exclusion to Windows Defender

Contains functionality to log keystrokes (.Net Source)

Found malware configuration

Injects a PE file into a foreign processes

Joe Sandbox ML detected suspicious sample

Loading BitLocker PowerShell Module

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Yara detected AntiVM3

Yara detected MassLogger RAT

Yara detected MSIL Logger

Yara detected Telegram RAT

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/c307a1875ba19a6e5a8127d23aec14b6e1661fae50a09e92ac971dd77e2e3341

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/c307a1875ba19a6e5a8127d23aec14b6e1661fae50a09e92ac971dd77e2e3341/

Threat name:

Win32.Trojan.Jalapeno

Status:

Malicious

First seen:

2025-03-25 06:57:55 UTC

AV detection:

18 of 24 (75.00%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ymd2db23ugng4wube7jdv3auw3qwmh5okcqj5evms4o5o7rognaq._file

Verdict:

malicious

Label(s):

unc_loader_037

novastealer

MassLogger

80edf30940ba58cb632cb8b5bbed7f57df1dbc9c682ddc744b9ed44af3583db8

MassLogger

91c51905a2db1c29aa562d975beac52d8895342b0ccecb16aeb5d40daa97d2b6

MassLogger

efa962fc10045f83da36ea363c43aba7a8d5ff3ec0e3aaa4c6480c2578b8c4fa

MassLogger

+ 1'484 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

8/10

Tags:

collection discovery execution spyware stealer

Link:

https://tria.ge/reports/250408-j5s6ba1ygw/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Checks computer location settings

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Command and Scripting Interpreter: PowerShell

Verdict:

Malicious

Tags:

404keylogger

YARA:

n/a

Link:

https://app.threat.zone/submission/c6cdedec-5e5d-4442-bce2-3bc2ac8d70a4

Unpacked files

SH256 hash:

c307a1875ba19a6e5a8127d23aec14b6e1661fae50a09e92ac971dd77e2e3341

MD5 hash:

c0adda26e0c007e3f0cc07e1fa959e47

SHA1 hash:

e5529cd1247b815bb78b98577508ba62dede6d73

Link:

https://www.unpac.me/results/45ac4fd2-873d-442d-90a7-a80a0da26c18/

SH256 hash:

7f24245d3ba0ddbe6907f1071b27e1c5a05112877b1d4ec4c1ce74d0b6621df1

MD5 hash:

44866ab397ca013874c760a9bfb4bcd6

SHA1 hash:

03123d253eced31d1d816f3da861216695daee17

Detections:

win_404keylogger_g1

win_masslogger_w0

MAL_Envrial_Jan18_1

INDICATOR_SUSPICIOUS_Binary_References_Browsers

INDICATOR_SUSPICIOUS_EXE_TelegramChatBot

Link:

https://www.unpac.me/results/45ac4fd2-873d-442d-90a7-a80a0da26c18/

Parent samples :

231f146362543fc6a0a100793a581a78db77b0e3ac90866c5ee747209daaecb0
91c51905a2db1c29aa562d975beac52d8895342b0ccecb16aeb5d40daa97d2b6
c307a1875ba19a6e5a8127d23aec14b6e1661fae50a09e92ac971dd77e2e3341
0a7a1c34834ee4656d7a05322c1c7cd38203bc3cfa694eac49f94b0350f13ef6
4f334f5a104cded0fc431d71abe76316f2ee4544b8d78d94a30da8189ff52411

SH256 hash:

a73b56ea97a6ebd952b65ec48bd9db38f0c0552c9baeb28230645fe909bedcfc

MD5 hash:

f9067b87cb469aafc8024a5a04a4cd56

SHA1 hash:

24666b0f3113d7bab04d6972c72d9687c48f7699

Detections:

SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24

SUSP_OBF_NET_Reactor_Indicators_Jan24

Link:

https://www.unpac.me/results/45ac4fd2-873d-442d-90a7-a80a0da26c18/

SH256 hash:

840b5cb34c9d0db90aaf9a368fcf84419cd4bbbc97a97f66bb4768d7260d7f87

MD5 hash:

77b66600025cac12a747a85b5815c5ae

SHA1 hash:

d9905ed9eced084856b72f10d28243bc476fef88

Link:

https://www.unpac.me/results/45ac4fd2-873d-442d-90a7-a80a0da26c18/

Malware family:

PrivateLogger

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/c307a1875ba1/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	INDICATOR_KB_CERT_7c1118cbbadc95da3752c46e47a27438 Create hunting rule
Author:	ditekSHen
Description:	Detects executables signed with stolen, revoked or invalid certificates

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

No further information available

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample