MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 56f14ce40e19fb067daf65a973dca1ca3c319834ced645613d72535db37882eb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	56f14ce40e19fb067daf65a973dca1ca3c319834ced645613d72535db37882eb
SHA3-384 hash:	acc58e78225872e43ed0ee7593fbe3a13e5ce759099b1e4c8b42683162273959244e4f59275fd81fdebb679fb702f35c
SHA1 hash:	a88648795860d16f2919d5f3c1273951bf9c16be
MD5 hash:	c682e38eb3d3cc288281744853dd5113
humanhash:	uncle-ten-nitrogen-twenty
File name:	rckki98773.hta
Download:	download sample
Signature	MassLogger Alert Create hunting rule
File size:	3'067'262 bytes
First seen:	2026-06-10 11:11:37 UTC
Last seen:	Never
File type:	hta
MIME type:	text/plain
ssdeep	1536:z4Pd90XFnwPjcfrlljALZ69PjAjAiganIf8h8lZz3PVgzgQpubw+q:zg+q
Threatray	1'675 similar samples on MalwareBazaar
TLSH	T17DE512ED529A7284CBC1635968EC618DE87104A737EF9B9E388B74CF4430F855428BB3
Magika	javascript
Reporter	lowmal3
Tags:	hta MassLogger

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

90

Origin country :

DE

Vendor Threat Intelligence

ACCE Unknown

No detections

CyberFortress Malicious

Verdict:

Malicious

Score:

91.7%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a2947d8a15110463ee4727e

Tags:

obfuscate xtreme shell

FileScan.IO Unknown

Verdict:

Unknown

Threat level:

  2.5/10

Confidence:

100%

Tags:

repaired

Link:

https://www.filescan.io/uploads/6a2947d8bf16337e43bfc451/reports/fea5c177-3a72-4730-a3fd-08050a762c31/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/56f14ce40e19fb067daf65a973dca1ca3c319834ced645613d72535db37882eb

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

hta

First seen:

2026-06-10T06:33:00Z UTC

Last seen:

2026-06-12T09:33:00Z UTC

Hits:

~1000

Detections:

HEUR:Trojan-Downloader.PowerShell.Agent.gen Trojan.JS.SAgent.sb HEUR:Trojan.Script.Generic

Link:

https://opentip.kaspersky.com/56f14ce40e19fb067daf65a973dca1ca3c319834ced645613d72535db37882eb/results?tab=lookup

Joe Sandbox MSIL Logger, MassLogger RAT

Result

Threat name:

MSIL Logger, MassLogger RAT

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1925788

Signature

Antivirus detection for URL or domain

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Creates processes via WMI

Found malware configuration

Injects a PE file into a foreign processes

Joe Sandbox ML detected suspicious sample

Malicious sample detected (through community Yara rule)

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: Silenttrinity Stager Msbuild Activity

Sigma detected: Suspicious MSHTA Child Process

Suricata IDS alerts for network traffic

Suspicious powershell command line found

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Yara detected MassLogger RAT

Yara detected MSIL Logger

Yara detected Powershell download and execute

Yara detected Telegram RAT

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

3%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/56f14ce40e19fb067daf65a973dca1ca3c319834ced645613d72535db37882eb

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/56f14ce40e19fb067daf65a973dca1ca3c319834ced645613d72535db37882eb/

Neiki Family.EMMENHTAL

Verdict:

Malicious

Threat:

Family.EMMENHTAL

Link:

https://tip.neiki.dev/file/56f14ce40e19fb067daf65a973dca1ca3c319834ced645613d72535db37882eb

ReversingLabs TitaniumCloud Win32.Trojan.Malgent

Threat name:

Win32.Trojan.Malgent

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-06-10 11:18:58 UTC

File Type:

Binary

AV detection:

6 of 24 (25.00%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=k3yuzzaodh5qm7npmwuxhxfbzi6ddgbuz3lekyj5ojjv3m3yqlvq._file

Threatray novastealer

Verdict:

malicious

Label(s):

novastealer

Alert

Create hunting rule

Similar samples:

026dd0a01c3d8969512184706f8c858b40bb19a09089d0172a0131dfa388f1b3

MassLogger

1fe4b1c7d4b24503a9941afaaef7b4a62bb081c522cd4a69c7c51fb879bdcdd9

MassLogger

2d8bbcadfe1614de3baaf2a4cd63b1f7d566d5535571c2a59f4d48ca1539b92c

MassLogger

2f73a285521422b982102ab6755a503efeb36a1719da5b8f3153e094220f5300

MassLogger

6963136965cd4a8cab567d7dc4435484e5a390946d3bb811878ce91f78ddc15c

MassLogger

968416f33911ac6dbdf52a31009d85d954bd3ad3d13aa73bf52d4731c2efa768

MassLogger

ba444a9c165e15fa526a24debffac9d5fb6610669d237a07817f3051db819f1d

MassLogger

c497271a900c6b2cb681d47b913e718efcff6ec00ec46138a82c30dfaaaa03b8

MassLogger

d292e299d37f2d90e8fb3758b9c75f813c9ec310aa088b6c937a189f48ed048c

MassLogger

error

MassLogger

+ 1'665 additional samples on MalwareBazaar

Hatching Triage masslogger

Result

Malware family:

masslogger

Alert

Create hunting rule

Score:

  10/10

Tags:

family:masslogger collection discovery execution spyware stealer

Link:

https://tria.ge/reports/260610-nd39eshs4z/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Family: MassLogger

Process spawned unexpected child process

Malware Config

Dropper Extraction:

https://icy-lab-0431.guilherme-telecomunicacoes2024.workers.dev/ZacAJ

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

0.83

Link:

https://yomi.yoroi.company/submissions/56f14ce40e19fb067daf65a973dca1ca3c319834ced645613d72535db37882eb