MALWARE FAMILY

MASS Logger

Internal ID: win.masslogger

aliases

Last seen:Mar 17, 2026

Intelligence Profile

MassLogger is a .NET credential stealer. It starts with a launcher that uses simple anti-debugging techniques which can be easily bypassed when identified. This first stage loader eventually XOR-decrypts the second stage assembly which then decrypts, loads and executes the final MassLogger payload.

Threat Analysis

MASS Logger is a malware family tracked by threat intelligence researchers and catalogued in the Malpedia dataset. It represents a distinct malicious software lineage with identifiable code characteristics, behaviors, and victimology.

External References

→https://blog.talosintelligence.com/2021/02/masslogger-cred-exfil.html

→https://blog.talosintelligence.com/2021/04/a-year-of-fajan-evolution-and-bloomberg.html

→https://decoded.avast.io/anhho/masslogger-v3-a-net-stealer-with-serious-obfuscation/

→https://fr3d.hk/blog/masslogger-frankenstein-s-creation

→https://maxkersten.nl/binary-analysis-course/malware-analysis/rezer0v4-loader/

→https://medium.com/@mariohenkel/decrypt-masslogger-2-4-0-0-configuration-eff3ee0720a7

→https://twitter.com/pancak3lullz/status/1255893734241304576

→https://www.fireeye.com/blog/threat-research/2020/08/bypassing-masslogger-anti-analysis-man-in-the-middle-approach.html

→https://www.gdatasoftware.com/blog/2020/06/36129-harmful-logging-diving-into-masslogger

→https://www.netresec.com/?page=Blog&month=2026-02&post=njRAT-runs-MassLogger

Quick Facts

TypeMalware Family

Aliases1

Also Known As

win.masslogger

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search MASS Logger