MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d9e876c0ef78f0d6087d0c41c8d47ebe9fc8137055c9d74bbb7c1fd7fb8e1fdf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 13


Intelligence 13 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d9e876c0ef78f0d6087d0c41c8d47ebe9fc8137055c9d74bbb7c1fd7fb8e1fdf
SHA3-384 hash: 1baa4f9d8f0b90cb0de6aeeea5e79b09bb47edfc18721e49c47a4d6e4bce560c80f63641667178cd8388cd107884656b
SHA1 hash: 35421ee8fe5b43da7467be47a42313ffa3076874
MD5 hash: 0dace8bac4b3d3c0c6140323d660bb12
humanhash: early-two-don-robert
File name:d9e876c0ef78f0d6087d0c41c8d47ebe9fc8137055c9d74bbb7c1fd7fb8e1fdf
Download: download sample
Signature MassLogger
Create hunting rule
File size:812'032 bytes
First seen:2026-08-10 14:28:55 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'191 x AgentTesla, 20'340 x Formbook, 12'364 x SnakeKeylogger)
ssdeep 24576:Gj/Og3FbJ/xzRlWdi3JjEYtbZTaiFjBLrvIXX:sPxJFH3NEEbMiFtPm
TLSH T1680513B567BADB06D2AA8BF00EB1E1B153B86D9EE421D3428FD7DCDB74217245108393
TrID 73.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
6.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.6% (.EXE) Win64 Executable (generic) (6522/11/2)
4.5% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter adrian__luca
Tags:exe MassLogger

Intelligence

File Origin
# of uploads :
1
# of downloads :
51
Origin country :
HU HU
Vendor Threat Intelligence
Malware configuration found for:
RoboSki
Details
Link:
https://research.acce.ciphertechsolutions.com/results/2221c47d-d055-4427-a48a-def786c6144d/
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/79892/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Сreating synchronization primitives
Creating a process with a hidden window
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Launching a process
Adding an exclusion to Microsoft Defender
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
entropy packed vbnet
Link:
https://www.filescan.io/uploads/6a79e0d069834dc6806955d1/reports/051a2423-1d33-49e2-84ea-582bc2761922/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/d9e876c0ef78f0d6087d0c41c8d47ebe9fc8137055c9d74bbb7c1fd7fb8e1fdf
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-07-17T08:59:00Z UTC
Last seen:
2026-08-11T02:48:00Z UTC
Hits:
~1000
Link:
https://opentip.kaspersky.com/d9e876c0ef78f0d6087d0c41c8d47ebe9fc8137055c9d74bbb7c1fd7fb8e1fdf/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/af3d6b4e-30d9-4687-ae1e-c9ec92f33866
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/d9e876c0ef78f0d6087d0c41c8d47ebe9fc8137055c9d74bbb7c1fd7fb8e1fdf
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d9e876c0ef78f0d6087d0c41c8d47ebe9fc8137055c9d74bbb7c1fd7fb8e1fdf/
Threat name:
ByteCode-MSIL.Spyware.Noon
Create hunting rule
Status:
Malicious
First seen:
2026-07-17 13:54:18 UTC
File Type:
PE (.Net Exe)
Extracted files:
4
AV detection:
29 of 36 (80.56%)
Threat level:
  2/5
Verdict:
malicious
Label(s):
NovaStealer
Create hunting rule
Link:
https://reports.threatray.com/85b331dd-fc13-46ad-b918-1596c94974b9
Result
Malware family:
masslogger
Create hunting rule
Score:
  10/10
Tags:
family:masslogger collection discovery execution persistence spyware stealer
Link:
https://tria.ge/reports/260810-rtx9wsbk9w/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
System Location Discovery: System Language Discovery
SmartAssembly .NET packer
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Adds Run key to start application
Looks up external IP address via web service
Checks computer location settings
Executes dropped EXE
Command and Scripting Interpreter: PowerShell
Family: MassLogger
Unpacked files
SH256 hash:
d9e876c0ef78f0d6087d0c41c8d47ebe9fc8137055c9d74bbb7c1fd7fb8e1fdf
MD5 hash:
0dace8bac4b3d3c0c6140323d660bb12
SHA1 hash:
35421ee8fe5b43da7467be47a42313ffa3076874
Link:
https://www.unpac.me/results/f985a333-55f2-4b65-8207-9eeda333b1e8/
SH256 hash:
01ff3e706f0f3928207b5e020eebb9ed38428dfbbf0f8c46aeec328b73519160
MD5 hash:
bbb0d2ca9a21d5a1f6c9059e108ea3ee
SHA1 hash:
5accd45f4a70a26b6ce07e04cc3820e99187a818
Link:
https://www.unpac.me/results/f985a333-55f2-4b65-8207-9eeda333b1e8/
SH256 hash:
eaf25dd110bc91ee5000644e517678981138ff9508e011600ace6351cdc83241
MD5 hash:
36eab044ee9af604f7e28e3a7ee0f525
SHA1 hash:
5bc0592f374a05b9e2233d194902b88791555cc6
Detections:
win_404keylogger_g1
Create hunting rule
win_masslogger_w0
Create hunting rule
triage_snakekeylogger_infostealer
Create hunting rule
Link:
https://www.unpac.me/results/f985a333-55f2-4b65-8207-9eeda333b1e8/
Parent samples :
d9e876c0ef78f0d6087d0c41c8d47ebe9fc8137055c9d74bbb7c1fd7fb8e1fdf
01ad626abefeb19a1fd65ec27599b6cdc0d025dc42261317e77480860ffa7a09
4a1b87430fe4ad7a1e9a35d99f7c612e7f2d8dce339edd172753aee1632653cc
SH256 hash:
d4a44fb073963f35663934b30f225bc263ee39e6871af941b467b293f305b79b
MD5 hash:
25dac4bb73032ba5e292ed9b7692c3fe
SHA1 hash:
5fe8acb1579cb943eb93328c03edeb2beec96655
Link:
https://www.unpac.me/results/f985a333-55f2-4b65-8207-9eeda333b1e8/
Malware family:
PrivateLogger
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/d9e876c0ef78/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d9e876c0ef78f0d6087d0c41c8d47ebe9fc8137055c9d74bbb7c1fd7fb8e1fdf

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/79892/

Comments