MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 efa962fc10045f83da36ea363c43aba7a8d5ff3ec0e3aaa4c6480c2578b8c4fa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

MassLogger

Vendor detections: 14

Intelligence 14 IOCs YARA 7 File information Comments

SHA256 hash:	efa962fc10045f83da36ea363c43aba7a8d5ff3ec0e3aaa4c6480c2578b8c4fa
SHA3-384 hash:	d0f8cba2d3a3536f652ae6b97c99e633a7d763da2257cc03f3af8aad235ba013adf9fdd5b7288abb205a4b2864ece010
SHA1 hash:	16399b67353194da101814b8969d3d05443915ab
MD5 hash:	34713ca0a7ca7d5ed19377c0ceb6b401
humanhash:	bacon-fifteen-monkey-happy
File name:	efa962fc10045f83da36ea363c43aba7a8d5ff3ec0e3aaa4c6480c2578b8c4fa
Download:	download sample
Signature	MassLogger Create hunting rule
File size:	560'136 bytes
First seen:	2025-04-08 08:09:47 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep	12288:d5GjvOn6nzxaDD+6wqIgNtFRkQsEDTfDkVjyaPifDC26PIWRskR:TGj2n6n0twqbRtsEnfDyjyaQhUIW1
Threatray	4'440 similar samples on MalwareBazaar
TLSH	T1EDC401A89B48E607C6C617750E70F27667BD2EDEA800C3138FE8ADDFB956F505C48252
TrID	71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10522/11/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4504/4/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika	pebin
Reporter	adrian__luca
Tags:	exe MassLogger

Intelligence

File Origin

# of uploads :

# of downloads :

355

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

efa962fc10045f83da36ea363c43aba7a8d5ff3ec0e3aaa4c6480c2578b8c4fa

Verdict:

Malicious activity

Analysis date:

2025-04-08 09:40:31 UTC

Tags:

snake keylogger evasion stealer ims-api generic

Link:

https://app.any.run/tasks/1be8c2bb-1bd4-4a52-ae23-52e05d92cea4

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Verdict:

Malicious

Score:

96.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67f4dbf2e011fe619fad1bce

Tags:

virus spawn msil

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Сreating synchronization primitives

Creating a process with a hidden window

Unauthorized injection to a recently created process

Restart of the analyzed sample

Creating a file

DNS request

Connection attempt

Sending an HTTP GET request

Sending a custom TCP request

Reading critical registry keys

Adding an exclusion to Microsoft Defender

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

expired-cert infostealer invalid-signature obfuscated packed packed packer_detected signed

Link:

https://www.filescan.io/uploads/67f4d9f7b070fb3f9460684c/reports/9185cd2a-7ff3-4ed6-8bac-5645e05d9eea/overview

Verdict:

Malicious

Labled as:

Jalapeno.Generic

Link:

https://www.hybrid-analysis.com/sample/efa962fc10045f83da36ea363c43aba7a8d5ff3ec0e3aaa4c6480c2578b8c4fa

Malware family:

Snake Keylogger

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/9d11471e-cd78-4d13-a279-a074d9548ecf

Result

Threat name:

MSIL Logger, MassLogger RAT

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1659955

Signature

.NET source code contains potential unpacker

.NET source code references suspicious native API functions

Adds a directory exclusion to Windows Defender

Antivirus / Scanner detection for submitted sample

Contains functionality to log keystrokes (.Net Source)

Found malware configuration

Joe Sandbox ML detected suspicious sample

Loading BitLocker PowerShell Module

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Yara detected AntiVM3

Yara detected MassLogger RAT

Yara detected MSIL Logger

Yara detected Telegram RAT

Behaviour

Behavior Graph:

Download SVG

Score:

99%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/efa962fc10045f83da36ea363c43aba7a8d5ff3ec0e3aaa4c6480c2578b8c4fa

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/efa962fc10045f83da36ea363c43aba7a8d5ff3ec0e3aaa4c6480c2578b8c4fa/

Threat name:

ByteCode-MSIL.Trojan.Jalapeno

Status:

Malicious

First seen:

2025-03-24 07:22:43 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

25 of 36 (69.44%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=56uwf7aqarpyhwrw5i3dyq5lu6unl7z6ydr2vjggjagck6fyyt5a._file

Verdict:

malicious

Label(s):

unc_loader_037

novastealer

MassLogger

80edf30940ba58cb632cb8b5bbed7f57df1dbc9c682ddc744b9ed44af3583db8

MassLogger

91c51905a2db1c29aa562d975beac52d8895342b0ccecb16aeb5d40daa97d2b6

MassLogger

c307a1875ba19a6e5a8127d23aec14b6e1661fae50a09e92ac971dd77e2e3341

MassLogger

efa962fc10045f83da36ea363c43aba7a8d5ff3ec0e3aaa4c6480c2578b8c4fa

MassLogger

error

MassLogger

+ 4'430 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

8/10

Tags:

collection discovery execution spyware stealer

Link:

https://tria.ge/reports/250408-j2y76a1qw4/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Checks computer location settings

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Command and Scripting Interpreter: PowerShell

Verdict:

Malicious

Tags:

404keylogger

YARA:

n/a

Link:

https://app.threat.zone/submission/4507318e-265c-4ea1-a6c8-a96b3d36ec96

Unpacked files

SH256 hash:

efa962fc10045f83da36ea363c43aba7a8d5ff3ec0e3aaa4c6480c2578b8c4fa

MD5 hash:

34713ca0a7ca7d5ed19377c0ceb6b401

SHA1 hash:

16399b67353194da101814b8969d3d05443915ab

Link:

https://www.unpac.me/results/91491e10-bb7c-405a-a346-65ae1866aa49/

SH256 hash:

cf68f822581c977624b554e9669f1dacd3ea27da419ce7d922c4fd7159a37655

MD5 hash:

ef21daeeb39441e28b0cc86cc0e23235

SHA1 hash:

1297757d3382f98c8d391ee50d0dd892ab4f4440

Link:

https://www.unpac.me/results/91491e10-bb7c-405a-a346-65ae1866aa49/

SH256 hash:

e71521007e64e4011f80f4fb6f8fa07b05be52e8088ed18c0c19881a6391fb45

MD5 hash:

cb717a71e67908fb20e04b13ebec3aec

SHA1 hash:

2f2e5d402c19c4cbd98fdace3b9049fc1c42d565

Detections:

win_404keylogger_g1

win_masslogger_w0

MAL_Envrial_Jan18_1

INDICATOR_SUSPICIOUS_Binary_References_Browsers

INDICATOR_SUSPICIOUS_EXE_TelegramChatBot

Link:

https://www.unpac.me/results/91491e10-bb7c-405a-a346-65ae1866aa49/

Parent samples :

7fc21521b3e61d0555c0c1adb947d9724c8ca61dc9caeef85a110ec46d3b2d5d
43d909c8afd4fe8010ca22bd90a2f65fd6e4275c36d103b91d0016f0c2988883
b8f79e1b5aecb07c83251141f0b128274c49697ebea217c83787abdf07fe00f2
e71521007e64e4011f80f4fb6f8fa07b05be52e8088ed18c0c19881a6391fb45
4be8e656872c1d27eeaec3bd38a9fd51648893ca4f8b79741b40e395ef91615e
35ebe17f33803f292a173b8652fdd9c69be8e6b89bc9897776e41c3a721b4211
efa962fc10045f83da36ea363c43aba7a8d5ff3ec0e3aaa4c6480c2578b8c4fa
1a98a78c6e63e52bd77d0a49c4738646e60c86e077174e523383509d2701f0e6
020b4368059e1fd314ad7299d62c0c1373fe19d6f8fae574d804c7f20c914de5
4dce97ef955a132177e7043fc0d11e35c3e1d03f833b3b30951d7b2ce6db735e

SH256 hash:

5252569f31de511454c97803c9d43911ef1bc5467a8c14d36d0c1411573eea9f

MD5 hash:

e6c53e275c20c33bf8326304fa041e36

SHA1 hash:

61da9bb5b3a8f81f4c5e996a62b1bf03a3c5254e

Detections:

SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24

SUSP_OBF_NET_Reactor_Indicators_Jan24

Link:

https://www.unpac.me/results/91491e10-bb7c-405a-a346-65ae1866aa49/

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	AgentTesla_DIFF_Common_Strings_01 Create hunting rule
Author:	schmidtsz
Description:	Identify partial Agent Tesla strings

Rule name:	INDICATOR_KB_CERT_7c1118cbbadc95da3752c46e47a27438 Create hunting rule
Author:	ditekSHen
Description:	Detects executables signed with stolen, revoked or invalid certificates

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

No further information available

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample