MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ff073aa55a06e3bebaf00eb6ddb92061e2a37ecd59b6c4f3a244b75c486e2311. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 18


Intelligence 18 IOCs YARA 23 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ff073aa55a06e3bebaf00eb6ddb92061e2a37ecd59b6c4f3a244b75c486e2311
SHA3-384 hash: 57533025ce9be1dad34bbb9b30067223f56f1f71588b87405376a4d78bda5b18390b77c5da0b6ea7477f5e6955922c27
SHA1 hash: f81331aa7cd1ccb6240817bda3b0c6f4b9fb9086
MD5 hash: 9f3e28617b444110b1e535394a632d0c
humanhash: iowa-sweet-colorado-bluebird
File name:Fiyat Teklif Talebi-DUYGUGROUP PDF.exe
Download: download sample
Signature MassLogger
Create hunting rule
File size:974'336 bytes
First seen:2026-04-28 08:54:34 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'097 x AgentTesla, 20'115 x Formbook, 12'356 x SnakeKeylogger)
ssdeep 24576:+Hn9qlWMTjlIazrsRZT8MI1CpXfA0znVBqyLBUN9uDfIilVm:uRMTjlIurg6L0pXY0zVLBU+z7
Threatray 26 similar samples on MalwareBazaar
TLSH T1902522F9AD09C147C9A70BF15EB6C33623A26EDDF005D356D3DCBDEB34A5290A828191
TrID 73.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
6.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.6% (.EXE) Win64 Executable (generic) (6522/11/2)
4.5% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter threatcat_ch
Tags:exe MassLogger

Intelligence

File Origin
# of uploads :
1
# of downloads :
191
Origin country :
CH CH
Vendor Threat Intelligence
Malware configuration found for:
RoboSki
Details
Link:
https://research.acce.ciphertechsolutions.com/results/b4001605-96b0-467f-9470-11bd68a67012/
Malware family:
n/a
ID:
1
File name:
exe
Verdict:
Malicious activity
Analysis date:
2026-04-28 08:55:51 UTC
Tags:
auto-startup evasion susp-lnk snake keylogger
Link:
https://app.any.run/tasks/a0150ce0-52cb-4459-b1ba-2756ea68bb6f

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
VIPKeyLogger
Create hunting rule
Link:
https://www.capesandbox.com/analysis/63849/
Detection(s):
SecuriteInfo.com.Win32.MalwareX-gen.43425421.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
DNS request
Connection attempt
Сreating synchronization primitives
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Creating a file in the %temp% directory
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Sending an HTTP GET request
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Enabling autorun by creating a file
Gathering data
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/ff073aa55a06e3bebaf00eb6ddb92061e2a37ecd59b6c4f3a244b75c486e2311
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-04-28T05:00:00Z UTC
Last seen:
2026-04-30T06:52:00Z UTC
Hits:
~1000
Detections:
PDM:Trojan.Win32.Generic HEUR:Trojan-Spy.MSIL.BPLogger.gen Trojan.MSIL.Inject.sb Trojan.MSIL.Crypt.sb Trojan.MSIL.Agent.sb Trojan-PSW.Win32.Stelega.sb Trojan-PSW.Win32.Stealer.sb Trojan.MSIL.Dnoper.sb HEUR:Trojan-Spy.MSIL.Agent.sb
Link:
https://opentip.kaspersky.com/ff073aa55a06e3bebaf00eb6ddb92061e2a37ecd59b6c4f3a244b75c486e2311/results?tab=lookup
Malware family:
Snake Keylogger
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/b01ad01d-dd9d-4e68-8560-f2d6403be9fd
Result
Threat name:
Snake Keylogger, VIP Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1905569
Signature
.NET source code references suspicious native API functions
AI detected malicious Powershell script
Bypasses PowerShell execution policy
Contains functionality to capture screen (.Net source)
Contains functionality to log keystrokes (.Net Source)
Found malware configuration
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sample uses string decryption to hide its real strings
Sigma detected: Script Interpreter Execution From Suspicious Folder
Sigma detected: Suspicious Script Execution From Temp Folder
Suricata IDS alerts for network traffic
Suspicious powershell command line found
Tries to detect the country of the analysis system (by using the IP)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses the Telegram API (likely for C&C communication)
Windows shortcut file (LNK) contains suspicious command line arguments
Yara detected AntiVM3
Yara detected Snake Keylogger
Yara detected Telegram RAT
Yara detected UAC Bypass using CMSTP
Yara detected VIP Keylogger
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1905569 Sample: Fiyat Teklif Talebi-DUYGUGR... Startdate: 28/04/2026 Architecture: WINDOWS Score: 100 35 reallyfreegeoip.org 2->35 37 api.telegram.org 2->37 39 2 other IPs or domains 2->39 47 Suricata IDS alerts for network traffic 2->47 49 Found malware configuration 2->49 51 Malicious sample detected (through community Yara rule) 2->51 57 17 other signatures 2->57 8 Fiyat Teklif Talebi-DUYGUGROUP PDF.exe 8 2->8         started        12 powershell.exe 19 2->12         started        signatures3 53 Tries to detect the country of the analysis system (by using the IP) 35->53 55 Uses the Telegram API (likely for C&C communication) 37->55 process4 file5 27 C:\Users\user\AppData\...\PLJxnRvhlSGCs.exe, PE32 8->27 dropped 29 C:\...\PLJxnRvhlSGCs.exe:Zone.Identifier, ASCII 8->29 dropped 31 C:\Users\user\AppData\...\24q210h1ofb.ps1, ASCII 8->31 dropped 33 Fiyat Teklif Taleb...GUGROUP PDF.exe.log, ASCII 8->33 dropped 63 Injects a PE file into a foreign processes 8->63 14 Fiyat Teklif Talebi-DUYGUGROUP PDF.exe 15 2 8->14         started        18 Fiyat Teklif Talebi-DUYGUGROUP PDF.exe 8->18         started        20 PLJxnRvhlSGCs.exe 3 12->20         started        22 conhost.exe 1 12->22         started        signatures6 process7 dnsIp8 41 api.telegram.org 149.154.166.110, 443, 49735, 49751 TELEGRAMRU United Kingdom 14->41 43 checkip.dyndns.com 193.122.130.0, 49720, 49723, 49726 ORACLE-BMC-31898US United States 14->43 45 reallyfreegeoip.org 172.67.177.134, 443, 49721, 49722 CLOUDFLARENETUS United States 14->45 65 Tries to steal Mail credentials (via file / registry access) 14->65 67 Multi AV Scanner detection for dropped file 20->67 24 PLJxnRvhlSGCs.exe 14 2 20->24         started        signatures9 process10 signatures11 59 Tries to steal Mail credentials (via file / registry access) 24->59 61 Tries to harvest and steal browser information (history, passwords, etc) 24->61
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/ff073aa55a06e3bebaf00eb6ddb92061e2a37ecd59b6c4f3a244b75c486e2311
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ff073aa55a06e3bebaf00eb6ddb92061e2a37ecd59b6c4f3a244b75c486e2311/
Verdict:
Malicious
Threat:
Family.SNAKE
Link:
https://tip.neiki.dev/file/ff073aa55a06e3bebaf00eb6ddb92061e2a37ecd59b6c4f3a244b75c486e2311
Threat name:
ByteCode-MSIL.Trojan.RedlineStealer
Create hunting rule
Status:
Malicious
First seen:
2026-04-28 08:56:13 UTC
File Type:
PE (.Net Exe)
Extracted files:
4
AV detection:
16 of 24 (66.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=74dtvjk2a3r35oxqb23n3ojamhrkg7wnlg3mj45cis3vysdoemiq._file
Verdict:
malicious
Label(s):
vipkeylogger
Create hunting rule
Similar samples:
22e20c87b8a58256ba2d789c04fa52c109cd991dd82f270e4c4da5b72f057b77
MassLogger
9f83da02dedfbcb29e357e652df8ad59e56ac797bf236d26fe8d9aebd6e17d98
MassLogger
b7bfcc457284207f51138847c2036298f2e70d98d51bcc35e34a64cc5c591fe5
MassLogger
be58ab597d111ad841b62d98a0ce2baf5f10000138fdc14b3a8209cf9065e3a1
MassLogger
c1809985bc96ceb090d1627981130698f934d033f8c45b49d8f07326ff11ab73
MassLogger
error
MassLogger
ff073aa55a06e3bebaf00eb6ddb92061e2a37ecd59b6c4f3a244b75c486e2311
MassLogger
+ 16 additional samples on MalwareBazaar
Result
Malware family:
vipkeylogger
Create hunting rule
Score:
  10/10
Tags:
family:vipkeylogger collection discovery keylogger spyware stealer
Link:
https://tria.ge/reports/260428-kvhghaa14l/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Browser Information Discovery
Enumerates physical storage devices
System Location Discovery: System Language Discovery
SmartAssembly .NET packer
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Drops startup file
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Family: VIPKeylogger
Unpacked files
SH256 hash:
ff073aa55a06e3bebaf00eb6ddb92061e2a37ecd59b6c4f3a244b75c486e2311
MD5 hash:
9f3e28617b444110b1e535394a632d0c
SHA1 hash:
f81331aa7cd1ccb6240817bda3b0c6f4b9fb9086
Link:
https://www.unpac.me/results/592fd691-b63e-4037-875b-09cb48895770/
SH256 hash:
bb3d24d570246fb54547b0d454490b1e026107622834a38d1f4dec21cafde9da
MD5 hash:
0037d5c7c53b634805bc44f1992201e8
SHA1 hash:
04755854d1d5f286fdc4907768d99bc28e95f3f8
Link:
https://www.unpac.me/results/592fd691-b63e-4037-875b-09cb48895770/
SH256 hash:
73139a3b6e28a45aa045fd2d29dbf8bf67513ef0c69253d5aadd83b1078da991
MD5 hash:
381ed0702e2bf658dccc75c1699a475e
SHA1 hash:
60897220d996fb4eb56593f43c35125cd892636c
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/592fd691-b63e-4037-875b-09cb48895770/
SH256 hash:
95892f0bc179246961e3cf5eeac444143a4f9b455ab740746dad3ecc32c93e62
MD5 hash:
694c313b660123f393332c2f0f7072b5
SHA1 hash:
ee790ec841b7761679a05771d551a154c7f87a93
Detections:
win_404keylogger_g1
Create hunting rule
win_masslogger_w0
Create hunting rule
triage_snakekeylogger_infostealer
Create hunting rule
MAL_Envrial_Jan18_1
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_DotNetProcHook
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_TelegramChatBot
Create hunting rule
Link:
https://www.unpac.me/results/592fd691-b63e-4037-875b-09cb48895770/
Parent samples :
9a0d20eec0a1e89a656a76aee82bf0619d8b83a0b445e095de190436dd110f42
256b9eb0b0ef69eeee00712c0e9fab59601934633f2bb6d0a0b10ac04bd5b2ab
75cc0d7abb4cb0145f0dc0639fbee4be7925dd45a38664e063095963c482ea78
68d311ac923f8a0854dbfa4d1401c84db61a2c530ec3fb6e1994a690fdfdd38d
5d67d216226094ebbc78b8c39e49b758e0b1624f904e2b6748bcfb39df8d6ed3
ceaa3016ce3897c17e580b58f2a41cc247de57bada3271b30aa389bcf3787ea0
553d904e1d73497fc05af9b9fa570cd6ea72043a445b2c358ce27bc84d28d226
f67799cd9ce6b4691134db9c85bab1ed79cb17d6b9b805916f118251b0d0f1e8
14b61a0155007f6e19dd356eb215652c7eb5dba764e5f059f3e37cbd273c3daa
55b98e06e135730fa23bd4af65b161ba5055a9e915164eb99b9402ad07e6e6df
141fcfa2abaae31d65da4145a537bfe13dd01ec9759d3bc1f6dd8d5ba5c1ff26
ba19434fbc08324b9a2e9ef01c34ce3818a3480f1efa03b864a38931d6d64642
364e64c2f1efc897342a41c5389f83d86cbc6b56e39abcd2a5e48e1a67fa1fae
3a0655a9973e8d7600f228240e1c3494b0acc55f46f218f42c12138d8ab73014
24d6cbd8f4eb920651f82adb1288cd4d5227f6bcd8fe71341ebdeb434bbfae01
dbd4edd258813db2cac4abddb2a4230b62874591c09daa6ffbcd5c9022ebd042
1439e036d8b04775d5462e7dbbb6e0b90e7668545f7ca5dae2aac74e84b184aa
95a769c7e3b0b372e3e4d9534127d61fdeef9186ccc99ed88cba00423178da29
5996e210f83d265a0c745ff669c388a834aedd25426ecee6ddc59111d06eefb0
ff073aa55a06e3bebaf00eb6ddb92061e2a37ecd59b6c4f3a244b75c486e2311
687e8747abfc36f1ad89e220d1f59c89e3214c71a98ec65417d486daa87eef8f
Malware family:
SnakeKeylogger
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/ff073aa55a06/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ff073aa55a06e3bebaf00eb6ddb92061e2a37ecd59b6c4f3a244b75c486e2311

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:crime_snake_keylogger
Create hunting rule
Author:Rony (r0ny_123)
Description:Detects Snake keylogger payload
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_DotNetProcHook
Create hunting rule
Author:ditekSHen
Description:Detects executables with potential process hoocking
Rule name:INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many email and collaboration clients. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_TelegramChatBot
Create hunting rule
Author:ditekSHen
Description:Detects executables using Telegram Chat Bot
Rule name:MAL_Envrial_Jan18_1
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects Encrial credential stealer malware
Reference:https://twitter.com/malwrhunterteam/status/953313514629853184
Rule name:MAL_Envrial_Jan18_1_RID2D8C
Create hunting rule
Author:Florian Roth
Description:Detects Encrial credential stealer malware
Reference:https://twitter.com/malwrhunterteam/status/953313514629853184
Rule name:masslogger_gcch
Create hunting rule
Author:govcert_ch
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:telebot_framework
Create hunting rule
Author:vietdx.mb
Rule name:TelegramAPIMalware_PowerShell_EXE
Create hunting rule
Author:@polygonben
Description:Hunting for pwsh malware using Telegram for C2
Rule name:telegram_bot_api
Create hunting rule
Author:rectifyq
Description:Detects file containing Telegram Bot API
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.
Rule name:VIPKeyLogger
Create hunting rule
Author:kevoreilly
Description:Detects VIPKeyLogger Keylogger
Rule name:Windows_Trojan_SnakeKeylogger_af3faa65
Create hunting rule
Author:Elastic Security
Rule name:win_masslogger_w0
Create hunting rule
Author:govcert_ch

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

Executable exe ff073aa55a06e3bebaf00eb6ddb92061e2a37ecd59b6c4f3a244b75c486e2311

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/63849/

Comments