MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f81e245a9e66e87936a2a6f09a71eec5014c2488a8cef657c9227d46f4588957. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	f81e245a9e66e87936a2a6f09a71eec5014c2488a8cef657c9227d46f4588957
SHA3-384 hash:	1e3ddb752594b3e447ef117d3bb1f239cc4448bcfaaa31627468be2b30f8cf2ffce509da25549ab6ddcbf3da5ed6e293
SHA1 hash:	f8ebda37bde84abd51901743984489f2590fb96f
MD5 hash:	52bc3cdf7f487587a9a01306651476e1
humanhash:	washington-alanine-chicken-ohio
File name:	Copia Pagamento Intesa_Sanpaolo_pdf.bat
Download:	download sample
Signature	MassLogger Alert Create hunting rule
File size:	195'320 bytes
First seen:	2025-01-17 09:50:34 UTC
Last seen:	Never
File type:	bat
MIME type:	text/x-msdos-batch
ssdeep	3072:MrT7EdnKSl3a4l2OwdnXsg7JzQ6DahrxmrSxUnQUCq9z/RFkshiNrHsB1xX1VbC:MrTKnJdai/wd8g7Jbahr4rSxwQKzxiNZ
Threatray	197 similar samples on MalwareBazaar
TLSH	T14F14E12209962F7B8A6E6A0EA0FD6916A3F20CAF705B7988E7337D371FE34CC5105545
Magika	vba
Reporter	lowmal3
Tags:	bat MassLogger

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

108

Origin country :

DE

Vendor Threat Intelligence

ANY.RUN Malicious

Malware family:

n/a

ID:

1

File name:

CopiaPagamentoIntesa_Sanpaolo_pdf.bat

Verdict:

Malicious activity

Analysis date:

2025-01-17 09:56:00 UTC

Tags:

evasion snake keylogger stealer telegram amsi-bypass ims-api generic

Link:

https://app.any.run/tasks/00cc1325-caa4-420c-b99a-5d4e8ab72b6d

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

ClamAV Detected

Detection(s):

SecuriteInfo.com.Other.Malware-gen.30498.14361.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

94.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=678a2808aa9c8e7858df2157

Tags:

obfuscated shell sage

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/f81e245a9e66e87936a2a6f09a71eec5014c2488a8cef657c9227d46f4588957

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Base64 Encoded Powershell Directives

Detected one or more base64 encoded Powershell directives.

Joe Sandbox MassLogger RAT

Result

Threat name:

MassLogger RAT

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1593555

Signature

.NET source code contains process injector

.NET source code contains very large strings

.NET source code references suspicious native API functions

AI detected suspicious sample

Contains functionality to log keystrokes (.Net Source)

Creates a thread in another existing process (thread injection)

Found malware configuration

Machine Learning detection for dropped file

Malicious sample detected (through community Yara rule)

PowerShell case anomaly found

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: Dot net compiler compiles file from suspicious location

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: Powershell Decrypt And Execute Base64 Data

Sigma detected: Suspicious PowerShell IEX Execution Patterns

Suricata IDS alerts for network traffic

Suspicious powershell command line found

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Uses ping.exe to check the status of other devices and networks

Uses the Telegram API (likely for C&C communication)

Writes to foreign memory regions

Yara detected MassLogger RAT

Yara detected Powershell decode and execute

Yara detected Telegram RAT

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

99%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/f81e245a9e66e87936a2a6f09a71eec5014c2488a8cef657c9227d46f4588957

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f81e245a9e66e87936a2a6f09a71eec5014c2488a8cef657c9227d46f4588957/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=7apciwu6m3uhsnvcu3yju4poyuauyjeivdhpmv6jej6un5cyrflq._file

Threatray snakekeylogger donut_injector

Verdict:

malicious

Label(s):

snakekeylogger

Alert

Create hunting rule

donut_injector

Alert

Create hunting rule

Similar samples:

195ee9a9f96abb146c2c217c659c7cd66093d607b9a64a1ffe976a32eee81b2c

MassLogger

80b3c8d9dcccf09f2cd697875d417ecfd90dc7ce3132ef10bc5d6f48510d19da

MassLogger

9155862979f292ea527e4107a7143bd9b54c66511a1aa1b04a06f924a4ed901d

MassLogger

b74937d0f19896f2d3256daf121395e8fcea20c8a509fac8fd5ebb95306fd00b

MassLogger

be9412060a9d41f496e907a637096255fa848a8ecb4bb4b35043f2e71ca871f6

MassLogger

error

MassLogger

+ 187 additional samples on MalwareBazaar

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  6/10

Tags:

collection discovery execution

Link:

https://tria.ge/reports/250117-lvgqmssnbl/

Behaviour

Kills process with taskkill

Runs ping.exe

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

System Network Configuration Discovery: Internet Connection Discovery

Accesses Microsoft Outlook profiles

Command and Scripting Interpreter: PowerShell

Looks up external IP address via web service

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/f81e245a9e66e87936a2a6f09a71eec5014c2488a8cef657c9227d46f4588957