MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 14c3023fd2bb18fd4095277f47582be9251c6aaa51c66c4a97659a2c2435ec36. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	14c3023fd2bb18fd4095277f47582be9251c6aaa51c66c4a97659a2c2435ec36
SHA3-384 hash:	1f833a0278aee136c61be15106176353fd441a2cbae0b4c14f6c62fe21a334529a114c9487c170e62716a4a6d4c4578d
SHA1 hash:	10baab6a31c84c76a55a2d381fdb3e3dbf89ad6c
MD5 hash:	23743481da66ea98c0a25ee7ce0c86fb
humanhash:	iowa-friend-fix-mobile
File name:	Request For RFQ-STACK120774-Handel GmbH 253736803-2024.js
Download:	download sample
Signature	MassLogger Alert Create hunting rule
File size:	1'608 bytes
First seen:	2025-03-27 11:54:36 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	12:Ny1uPF5pm0PF5pmsNPF5pWZVWNGF5pqxEVF5p0F5p0F5p/0PF5pdZF5peF5pvF5/:KuMxIEGVx+0vM0ns2Uhgn1K
Threatray	736 similar samples on MalwareBazaar
TLSH	T16931D7056C04D0FEC41792119111E92EF6DE2DBE81F0DDBEA43D20AD66C4EACB7AC708
Magika	javascript
Reporter	TeamDreier
Tags:	js MassLogger

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

463

Origin country :

DK

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.PUA.JS.Downloader-133.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67e53cbccb6d38a89f3ea084

Tags:

obfuscate xtreme shell

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

obfuscated

Link:

https://www.filescan.io/uploads/67e53cb0631830704a891739/reports/c22651ed-1b43-45ac-9e2d-eb6e89168c86/overview

Hybrid Analysis JS/TrojanDownloader.Agent

Verdict:

Malicious

Labled as:

JS/TrojanDownloader.Agent

Link:

https://www.hybrid-analysis.com/sample/14c3023fd2bb18fd4095277f47582be9251c6aaa51c66c4a97659a2c2435ec36

InQuest UNKNOWN

Result

Verdict:

UNKNOWN

Joe Sandbox MSIL Logger, MassLogger RAT

Result

Threat name:

MSIL Logger, MassLogger RAT

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1650069

Signature

.NET source code references suspicious native API functions

Connects to a pastebin service (likely for C&C)

Contains functionality to log keystrokes (.Net Source)

Found malware configuration

Injects a PE file into a foreign processes

Joe Sandbox ML detected suspicious sample

JScript performs obfuscated calls to suspicious functions

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: Script Initiated Connection to Non-Local Network

Sigma detected: WScript or CScript Dropper

Suricata IDS alerts for network traffic

Suspicious execution chain found

Suspicious powershell command line found

System process connects to network (likely due to code injection or exploit)

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

Wscript starts Powershell (via cmd or directly)

Yara detected MassLogger RAT

Yara detected MSIL Logger

Yara detected Powershell decode and execute

Yara detected Powershell download and execute

Yara detected Telegram RAT

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/14c3023fd2bb18fd4095277f47582be9251c6aaa51c66c4a97659a2c2435ec36/

ReversingLabs TitaniumCloud Script.Trojan.Generic

Threat name:

Script.Trojan.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2025-03-27 11:55:27 UTC

File Type:

Binary

AV detection:

9 of 24 (37.50%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ctbqep6sxmmp2qeve57uowbl5esry2vkkhdgysuxmwncyjbv5q3a._file

Threatray novastealer

Verdict:

malicious

Label(s):

novastealer

Alert

Create hunting rule

Similar samples:

14d370a69c8c075b14a411301bc9137d1db0683ac4ff480d25404d9f81533f66

MassLogger

319bbb344dec636f30b684b16fe038eb82f7a53dcfb7d6cbd27f7361004ae78c

MassLogger

38f73caeeb18b876e4ce3f07c3b0f3b6e145ae6ff1fc0f708448e40729a17861

MassLogger

3eb8c9eabc1103144e34043483c923c576ceba5e2a64a0e98c6ef12160b8ac91

MassLogger

b1520b6a3358bbcad7d55344f3d7bd2e75a9075ef4afd3f7c23de5def92daad0

MassLogger

bedb516c0bbfe25e36c26f81d37be534ab096c087fc4e866fb20bf68cf4b9123

MassLogger

error

MassLogger

+ 726 additional samples on MalwareBazaar

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

collection discovery execution

Link:

https://tria.ge/reports/250327-n3lqns1wey/

Behaviour

Modifies system certificate store

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Command and Scripting Interpreter: PowerShell

Looks up external IP address via web service

Checks computer location settings

Blocklisted process makes network request

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/14c3023fd2bb18fd4095277f47582be9251c6aaa51c66c4a97659a2c2435ec36