MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 029f85d0a2a4be32deb2095000e8f07e0775a0cf738403d069245bfdb0b39c37. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	029f85d0a2a4be32deb2095000e8f07e0775a0cf738403d069245bfdb0b39c37
SHA3-384 hash:	ff67b6377fc189111ebf7dc17c61d58eb212fcb1764c6e5e7af952582a2940c9e012fe6f5b1e474b82f4f64b47acbb09
SHA1 hash:	2c66dce7b3d67295a16c4ab4e7dc57ef7bef0fc5
MD5 hash:	e2999197745ce8d2d03338e4702136ed
humanhash:	fanta-georgia-echo-fifteen
File name:	RFQ-UAE8092-08Unit.js
Download:	download sample
Signature	MassLogger Alert Create hunting rule
File size:	129'405 bytes
First seen:	2025-05-27 15:05:28 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	3072:PSV5YmTFVSaVv0uR37hXfwNZqjbpCDAlMIY7xULyhLybn:PAYmTFVS3uJ7hXfwNcj0M50U2hm
Threatray	1'055 similar samples on MalwareBazaar
TLSH	T104C31A3EE9B45DCEA36135C22994A23050994F73E933DF3FB5F128EA1D2C6095AB4C64
Magika	javascript
Reporter	abuse_ch
Tags:	js MassLogger

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

417

Origin country :

NL

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.BAT.Obfus-3.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

94.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6835d5f4668438e362e7738c

Tags:

obfuscate xtreme shell

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

base64 evasive obfuscated powershell

Link:

https://www.filescan.io/uploads/6835d4ec171e01f9592e7711/reports/e060621e-01b9-4cca-ae65-b2a663ec452d/overview

Hybrid Analysis Trojan.Generic

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/029f85d0a2a4be32deb2095000e8f07e0775a0cf738403d069245bfdb0b39c37

Joe Sandbox Batch Injector, MSIL Logger, MassLogger

Result

Threat name:

Batch Injector, MSIL Logger, MassLogger

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1699947

Signature

.NET source code contains potential unpacker

.NET source code references suspicious native API functions

Bypasses PowerShell execution policy

Contains functionality to log keystrokes (.Net Source)

Found malware configuration

Found suspicious powershell code related to unpacking or dynamic code loading

Joe Sandbox ML detected suspicious sample

JScript performs obfuscated calls to suspicious functions

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: PowerShell Base64 Encoded Invoke Keyword

Sigma detected: Suspicious PowerShell Parameter Substring

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Yara detected Batch Injector

Yara detected MassLogger RAT

Yara detected MSIL Logger

Yara detected Powershell decode and execute

Yara detected Telegram RAT

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/029f85d0a2a4be32deb2095000e8f07e0775a0cf738403d069245bfdb0b39c37

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/029f85d0a2a4be32deb2095000e8f07e0775a0cf738403d069245bfdb0b39c37/

ReversingLabs TitaniumCloud Script.Packed.Generic

Threat name:

Script.Packed.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2025-05-26 07:28:52 UTC

File Type:

Text (HTML)

AV detection:

11 of 24 (45.83%)

Threat level:

  1/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=akpylufcus7dfxvsbfiab2hqpydxligpoocahudjern73mfttq3q._file

Threatray novastealer

Verdict:

malicious

Label(s):

novastealer

Alert

Create hunting rule

Similar samples:

097281445fcbf123697ab8a201a2702012b8d84ad6aac609a56934e87308dc3a

MassLogger

bedb516c0bbfe25e36c26f81d37be534ab096c087fc4e866fb20bf68cf4b9123

MassLogger

c9b5da30a6700f6781b1958adbea63e4553b73cac666baa342974ed00a1f4668

MassLogger

dc89f1981a7cc11ca6074aec4c09e0a1154d31474a0f51a5e5d57153741a00bd

MassLogger

error

MassLogger

f344de0d137247e297701368c696119f63122fdf8b08c0893eaff7eea50c6fc9

MassLogger

f42f597fbe95023f89a4ea65366f40d8c53321122add06b68826dfb7be7b5a21

MassLogger

+ 1'045 additional samples on MalwareBazaar

Hatching Triage masslogger

Result

Malware family:

masslogger

Alert

Create hunting rule

Score:

  10/10

Tags:

family:masslogger collection discovery execution spyware stealer

Link:

https://tria.ge/reports/250527-sgr3sawmx7/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Accesses Microsoft Outlook profiles

Command and Scripting Interpreter: PowerShell

Looks up external IP address via web service

Checks computer location settings

Blocklisted process makes network request

MassLogger

Masslogger family

VMRay MassLogger

Malware family:

MassLogger

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/029f85d0a2a4/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/029f85d0a2a4be32deb2095000e8f07e0775a0cf738403d069245bfdb0b39c37