MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dfd642ed5f14bce81563b3921c242393a9ac2a1865a8344af8b29b9faaa16a7f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	dfd642ed5f14bce81563b3921c242393a9ac2a1865a8344af8b29b9faaa16a7f
SHA3-384 hash:	007c9e3976ee6118f82083da846c56e917216a6a27fa900c023eabd3c41268658f977f54e9b4c77951c045c451daa87e
SHA1 hash:	57d2dd2565c041d08bdcd852908e72fdaf1e2519
MD5 hash:	c0c9edfbc5bfdf460fee48fbc1320835
humanhash:	river-three-mars-friend
File name:	Fizetési_másolat_UniCredit Bank_Hungary.bat
Download:	download sample
Signature	MassLogger Alert Create hunting rule
File size:	396'390 bytes
First seen:	2025-04-01 05:50:23 UTC
Last seen:	2025-05-27 07:59:01 UTC
File type:	bat
MIME type:	text/plain
ssdeep	12288:tjBEc3VepVqEFV6dylARp8DGalqx9ydnGNn:tjM1FV0rpYdwxK4
Threatray	841 similar samples on MalwareBazaar
TLSH	T18284C0711DC0ADDB4E2EEF2EC166264D2263D9BD3871328E26131ED8D76F042AD27586
Magika	vba
Reporter	smica83
Tags:	bat HUN MassLogger UniCreditEurope

Intelligence

---

File Origin

# of uploads :

3

# of downloads :

91

Origin country :

HU

Vendor Threat Intelligence

ANY.RUN Malicious

Malware family:

n/a

ID:

1

File name:

Copia de pago_Banco_BBVA.bat

Verdict:

Malicious activity

Analysis date:

2025-03-28 12:52:55 UTC

Tags:

snake keylogger evasion stealer ims-api generic

Link:

https://app.any.run/tasks/05973df7-6ec1-4e31-aad0-bce07cc93276

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

ClamAV Detected

Detection(s):

SecuriteInfo.com.Other.Malware-gen.16731.14888.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67eb81fc855e5ec5240b4148

Tags:

obfuscated shell virus

Joe Sandbox MSIL Logger, MassLogger RAT

Result

Threat name:

MSIL Logger, MassLogger RAT

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1653409

Signature

.NET source code contains potential unpacker

.NET source code contains very large strings

.NET source code references suspicious native API functions

Contains functionality to log keystrokes (.Net Source)

Creates a thread in another existing process (thread injection)

Found malware configuration

Joe Sandbox ML detected suspicious sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

PowerShell case anomaly found

Powershell drops PE file

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: PowerShell Base64 Encoded IEX Cmdlet

Suspicious command line found

Suspicious powershell command line found

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Uses ping.exe to check the status of other devices and networks

Writes to foreign memory regions

Yara detected MassLogger RAT

Yara detected MSIL Logger

Yara detected Telegram RAT

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

97%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/dfd642ed5f14bce81563b3921c242393a9ac2a1865a8344af8b29b9faaa16a7f

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/dfd642ed5f14bce81563b3921c242393a9ac2a1865a8344af8b29b9faaa16a7f/

ReversingLabs TitaniumCloud Win32.Exploit.Minerva

Threat name:

Win32.Exploit.Minerva

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-03-27 21:40:10 UTC

File Type:

Text

AV detection:

11 of 36 (30.56%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=37lef3k7cs6oqfldwojbyjbdsou2ykqymwudisxywknz7kvbnj7q._file

Threatray donut_injector novastealer

Verdict:

malicious

Label(s):

donut_injector

Alert

Create hunting rule

novastealer

Alert

Create hunting rule

Similar samples:

13468d59ce57b2c059aa39c0ae0a1753c93ce9cae130a23d0ea306f3aaf1773c

MassLogger

14f6cc465c16b2b06dca025ac97d6824d0793554b1599b68e401379b4f2cb12a

MassLogger

27be1fda8c87477ab97c0df0ff72311f87a80f404337f1bb269e37dbe266972d

MassLogger

6357866d9a4110843c44f4a4986d50a0af5380f4e185373d062f123d73fe63d9

MassLogger

8432a87c1daeb7a4a13a6bee0ab55d5c96919b2d29dfddc5682f9289023a5ed6

MassLogger

b41c2dc07ebec91f9606b75710eab439f1a4928874180aa36748527f96512c8d

MassLogger

ced40caee716f956a4db4d96f10daa8b80f6c30371f2490129b6cf212dcfd223

MassLogger

error

MassLogger

f99267a4d305fa5fbbcc6c474c8dc3f0c071e837829db5ec805a67161270d7f1

MassLogger

+ 831 additional samples on MalwareBazaar

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

collection discovery execution

Link:

https://tria.ge/reports/250401-gj7epsvsax/

Behaviour

Runs ping.exe

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

System Location Discovery: System Language Discovery

System Network Configuration Discovery: Internet Connection Discovery

Accesses Microsoft Outlook profiles

Command and Scripting Interpreter: PowerShell

Looks up external IP address via web service

Loads dropped DLL

VMRay PrivateLogger

Malware family:

PrivateLogger

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/dfd642ed5f14/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/dfd642ed5f14bce81563b3921c242393a9ac2a1865a8344af8b29b9faaa16a7f