MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ca1d58e35c31bd800519adc8167d1485b6b4d0ec2d0fe4123a4ec9d5b4e5fc4c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 17


Intelligence 17 IOCs YARA 20 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ca1d58e35c31bd800519adc8167d1485b6b4d0ec2d0fe4123a4ec9d5b4e5fc4c
SHA3-384 hash: ee5ce1b8be1c84c5ffe3a8bf183c1e3dd773283346b143a3621a0357d7934fa341160564851f911c3ff2e4bef37e20bd
SHA1 hash: d7a38e892c91485ecbd198ba7797cb5452466500
MD5 hash: bc9d5eb533562bbe46f221b92759d592
humanhash: eighteen-march-vegan-michigan
File name:ca1d58e35c31bd800519adc8167d1485b6b4d0ec2d0fe4123a4ec9d5b4e5fc4c
Download: download sample
Signature MassLogger
Create hunting rule
File size:769'024 bytes
First seen:2025-12-08 14:40:35 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'747 x AgentTesla, 19'636 x Formbook, 12'244 x SnakeKeylogger)
ssdeep 12288:8j5KfHJex/ux/GV7vdVotdMx/tfh8J85HJtFfPUgjWIHDX1SqQTBfNKjl5Sd7kcD:87xWxeVzdyMxVh8J8LtFU0WIHDa1NmsJ
Threatray 2'922 similar samples on MalwareBazaar
TLSH T118F4F15472789823C97456F91E60F63027F92EAEB212C6CA8ED92CDF79E6F014D04A53
TrID 69.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.0% (.EXE) Win64 Executable (generic) (10522/11/4)
6.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.2% (.EXE) Win32 Executable (generic) (4504/4/1)
1.9% (.EXE) Win16/32 Executable Delphi generic (2072/23)
Magika pebin
Reporter adrian__luca
Tags:exe MassLogger

Intelligence

File Origin
# of uploads :
1
# of downloads :
72
Origin country :
HU HU
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/38fe555a-1193-4835-9f37-f1e5e610a3b2/
Malware family:
n/a
ID:
1
File name:
ca1d58e35c31bd800519adc8167d1485b6b4d0ec2d0fe4123a4ec9d5b4e5fc4c
Verdict:
Malicious activity
Analysis date:
2025-12-08 16:33:05 UTC
Tags:
snake keylogger evasion telegram stealer
Link:
https://app.any.run/tasks/b1d4f0a5-5397-4b01-ae0b-d08b015efc52

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
VIPKeyLogger
Create hunting rule
Link:
https://www.capesandbox.com/analysis/43114/
Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6936e395db58e1a2c22b8344
Tags:
shell virus msil
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/ca1d58e35c31bd800519adc8167d1485b6b4d0ec2d0fe4123a4ec9d5b4e5fc4c
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-11-11T01:55:00Z UTC
Last seen:
2025-12-10T10:20:00Z UTC
Hits:
~1000
Link:
https://opentip.kaspersky.com/ca1d58e35c31bd800519adc8167d1485b6b4d0ec2d0fe4123a4ec9d5b4e5fc4c/results?tab=lookup
Malware family:
Snake Keylogger
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/7d0138ef-c8e2-416a-baac-3bc25178f060
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/ca1d58e35c31bd800519adc8167d1485b6b4d0ec2d0fe4123a4ec9d5b4e5fc4c
Verdict:
inconclusive
YARA:
10 match(es)
Tags:
.Net Executable Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.33 Win 32 Exe x86
Link:
https://app.malva.re/file/bc9d5eb533562bbe46f221b92759d592
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ca1d58e35c31bd800519adc8167d1485b6b4d0ec2d0fe4123a4ec9d5b4e5fc4c/
Threat name:
ByteCode-MSIL.Spyware.Negasteal
Create hunting rule
Status:
Malicious
First seen:
2025-11-11 06:03:18 UTC
File Type:
PE (.Net Exe)
Extracted files:
17
AV detection:
27 of 36 (75.00%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ziovry24gg6yabizvxebm7iuqw3ljuhmfuh6ier2j3e5lnhf7rga._file
Verdict:
malicious
Label(s):
vipkeylogger
Create hunting rule
unc_loader_037
Create hunting rule
Similar samples:
09b8a80183a41a92c60fbacf9ee319291e37ae6d4ce0521b23b236b46e095956
MassLogger
544afe8840ec6a6f9db0062d6713264aabe6ffc9afbd4fd6438e0f3c76c3d2ae
MassLogger
7db983607b14ea67a3d656542e033ba69fdbd3a4bcb7bea0251205d219ab71bd
MassLogger
8ece82ad36ddad1e13a955098ea9629364950ed21a1155d7be4921208e62eb0c
MassLogger
ca1d58e35c31bd800519adc8167d1485b6b4d0ec2d0fe4123a4ec9d5b4e5fc4c
MassLogger
e12b5b829cc5821f7f99f9dd8a11d22da157eb3259b29c40a8ea61acdd3be4b0
MassLogger
error
MassLogger
+ 2'912 additional samples on MalwareBazaar
Result
Malware family:
vipkeylogger
Create hunting rule
Score:
  10/10
Tags:
family:vipkeylogger collection discovery execution keylogger spyware stealer
Link:
https://tria.ge/reports/251208-r2atkaylbq/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Browser Information Discovery
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Checks computer location settings
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Command and Scripting Interpreter: PowerShell
VIPKeylogger
Vipkeylogger family
Verdict:
Malicious
Tags:
404Keylogger
YARA:
n/a
Link:
https://app.threat.zone/submission/373d094b-971f-4a78-ae9c-fff2bc1bc7ed
Unpacked files
SH256 hash:
ca1d58e35c31bd800519adc8167d1485b6b4d0ec2d0fe4123a4ec9d5b4e5fc4c
MD5 hash:
bc9d5eb533562bbe46f221b92759d592
SHA1 hash:
d7a38e892c91485ecbd198ba7797cb5452466500
Link:
https://www.unpac.me/results/fee53bfd-6231-4a2b-89f0-7ec48fa30606/
SH256 hash:
aff7eac07e9dbd72e4af6d9bbfae5ddce77b76ebc4320d0aaad1f8f845a80f64
MD5 hash:
352c435acd6301d6f91213307a9b04ac
SHA1 hash:
30fc114ac089c3de647660b2991171d52fcc9262
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/fee53bfd-6231-4a2b-89f0-7ec48fa30606/
SH256 hash:
f1e4d39b9ed801e08650caf5b7611cdad30cc193a7c9cacb0f15276dda3ee713
MD5 hash:
8bec2fe93faac6a90bd46058957e386b
SHA1 hash:
360a9032cf35d6675ba62bfe22dd25bfd39732e8
Link:
https://www.unpac.me/results/fee53bfd-6231-4a2b-89f0-7ec48fa30606/
SH256 hash:
71ed78dca47c08ec160c624ef7689146efd633b5891ae612e7c78aace6429446
MD5 hash:
41932e6d9a2b3b292df99054c40fa963
SHA1 hash:
e9750bf138dacd6263d0f62d57a1e18f93ae86b5
Detections:
win_404keylogger_g1
Create hunting rule
win_masslogger_w0
Create hunting rule
MAL_Envrial_Jan18_1
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_DotNetProcHook
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_TelegramChatBot
Create hunting rule
Link:
https://www.unpac.me/results/fee53bfd-6231-4a2b-89f0-7ec48fa30606/
Parent samples :
6b24a51a6be4e3c3166d63664e5246da89ea1b7b400e8b4857f6eebbfa9d1490
69f81d677a41d9cdcea7d67ca0afb52708ad74b40788e2f101d414bcc5b6b670
8f0e207db3ead508c0e0719056b67faae2a3b085bc04311b4a071bb80e443410
5f48d305796678318ea7079fc781c4801c7c2b40cfde29cef154568228f3f5e5
1102be281ceadcc5966ddd8ed9fb1fe436d920bbfcd376dd9ba252ab03d84c7b
04eca2d8e55732a9c4d49d7fc90bd2e9996903df22bb76e77797b08252c517a8
ca1d58e35c31bd800519adc8167d1485b6b4d0ec2d0fe4123a4ec9d5b4e5fc4c
Malware family:
VIPKeylogger
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/ca1d58e35c31/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ca1d58e35c31bd800519adc8167d1485b6b4d0ec2d0fe4123a4ec9d5b4e5fc4c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:crime_snake_keylogger
Create hunting rule
Author:Rony (r0ny_123)
Description:Detects Snake keylogger payload
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_DotNetProcHook
Create hunting rule
Author:ditekSHen
Description:Detects executables with potential process hoocking
Rule name:INDICATOR_SUSPICIOUS_EXE_TelegramChatBot
Create hunting rule
Author:ditekSHen
Description:Detects executables using Telegram Chat Bot
Rule name:MAL_Envrial_Jan18_1
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects Encrial credential stealer malware
Reference:https://twitter.com/malwrhunterteam/status/953313514629853184
Rule name:MAL_Envrial_Jan18_1_RID2D8C
Create hunting rule
Author:Florian Roth
Description:Detects Encrial credential stealer malware
Reference:https://twitter.com/malwrhunterteam/status/953313514629853184
Rule name:masslogger_gcch
Create hunting rule
Author:govcert_ch
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:TelegramAPIMalware_PowerShell_EXE
Create hunting rule
Author:@polygonben
Description:Hunting for pwsh malware using Telegram for C2
Rule name:telegram_bot_api
Create hunting rule
Author:rectifyq
Description:Detects file containing Telegram Bot API
Rule name:VIPKeyLogger
Create hunting rule
Author:kevoreilly
Description:Detects VIPKeyLogger Keylogger
Rule name:Windows_Trojan_SnakeKeylogger_af3faa65
Create hunting rule
Author:Elastic Security
Rule name:win_masslogger_w0
Create hunting rule
Author:govcert_ch

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/43114/

Comments