MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 14c618dec5ec31c655ae3c518d2af66c6b5e44162b68c20e725f1ab76bf281cd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	14c618dec5ec31c655ae3c518d2af66c6b5e44162b68c20e725f1ab76bf281cd
SHA3-384 hash:	fcde62667455c8ad7540fd8d7f6c58c71bb5c14ee1c3e564d1f6d70690290fce6667fd29629186148ae7110c45ee2f7d
SHA1 hash:	3b90b047e90d59e40ce855a07fcfb3e9cfbaac40
MD5 hash:	47af348402ab6750f67c9c14fda0b6ac
humanhash:	skylark-papa-uranus-golf
File name:	PAGO.js
Download:	download sample
Signature	MassLogger Alert Create hunting rule
File size:	2'516'409 bytes
First seen:	2026-06-23 12:08:37 UTC
Last seen:	Never
File type:	js
MIME type:	application/octet-stream
ssdeep	384:dQt2S1T8ovO31Hmpe9m7VTdc1fVm+YP6ROf8JVivLqbGB6YUc/kE25QhtlxRx7Ih:Ww
TLSH	T177C5128636A4B0CECACA73D14E48F7939B07324D7BE361E93A0327F55D860782945DB6
Magika	javascript
Reporter	James_inthe_box
Tags:	exe js MassLogger

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

166

Origin country :

US

Vendor Threat Intelligence

ACCE Unknown

No detections

CyberFortress Clean

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a3a780d1548daf709f921c2

Tags:

n/a

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

aes anti-vm base64 crypto fingerprint obfuscated overlay powershell repaired

Link:

https://www.filescan.io/uploads/6a3a78a362d0679105fd12af/reports/7c7272c2-7fb1-4ed6-afc5-235777ddea3e/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/14c618dec5ec31c655ae3c518d2af66c6b5e44162b68c20e725f1ab76bf281cd

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

First seen:

2026-06-23T08:02:00Z UTC

Last seen:

2026-06-25T10:38:00Z UTC

Hits:

~1000

Detections:

Trojan.JS.SAgent.sb HEUR:Trojan.Script.Generic

Link:

https://opentip.kaspersky.com/14c618dec5ec31c655ae3c518d2af66c6b5e44162b68c20e725f1ab76bf281cd/results?tab=lookup

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/14c618dec5ec31c655ae3c518d2af66c6b5e44162b68c20e725f1ab76bf281cd/

Neiki Family.SNAKE

Verdict:

Malicious

Threat:

Family.SNAKE

Link:

https://tip.neiki.dev/file/14c618dec5ec31c655ae3c518d2af66c6b5e44162b68c20e725f1ab76bf281cd

ReversingLabs TitaniumCloud Win32.Trojan.Generic

Threat name:

Win32.Trojan.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2026-06-23 12:08:20 UTC

File Type:

Binary

AV detection:

7 of 24 (29.17%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ctdbrxwf5qy4mvnohriy2kxwnrvv4rawfnumedtsl4nlo27sqhgq._file

Hatching Triage masslogger

Result

Malware family:

masslogger

Alert

Create hunting rule

Score:

  10/10

Tags:

family:masslogger collection discovery execution spyware stealer

Link:

https://tria.ge/reports/260623-peh6bacx7s/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Command and Scripting Interpreter: JavaScript

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Command and Scripting Interpreter: PowerShell

Looks up external IP address via web service

Badlisted process makes network request

Family: MassLogger

Process spawned unexpected child process

Malware Config

C2 Extraction:

https://api.telegram.org/bot8863119254:AAH253pnN63l3kHxRxN-9CdTBo712ifHgpM/sendMessage?chat_id=8153569978

VMRay BabelVM

Malware family:

BabelVM

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/14c618dec5ec/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.55

Link:

https://yomi.yoroi.company/submissions/14c618dec5ec31c655ae3c518d2af66c6b5e44162b68c20e725f1ab76bf281cd