MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 68aea9911a10b2b3ffc1d5b08ee110390a567de16c7cc4e3c60969752f92741b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	68aea9911a10b2b3ffc1d5b08ee110390a567de16c7cc4e3c60969752f92741b
SHA3-384 hash:	55a1f18eea92d66049e93fe4b2ac237b4c1ed59815b9f1e89e653f9aac9ffdcd27f7b57fbc94f702919a50adfcafc754
SHA1 hash:	17993d1b85f089d3c49fbd7e569a349509129163
MD5 hash:	5bd2852c61cc919340287e61d657c8f5
humanhash:	william-butter-winter-alabama
File name:	SHRS(E-5274).js
Download:	download sample
Signature	MassLogger Alert Create hunting rule
File size:	7'952'898 bytes
First seen:	2026-06-25 04:51:22 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	12288:3FTeRu7lSwE2aooXTyoStfl7XT9O7vyU4ZnoTt3TLIikP6PPQkshmgrwQvZEZg/P:wPC3
TLSH	T16986CF6AADE3323D7133D8F959F28579C8A2E1627B4D416E034A1703DE267C5DA01E2F
TrID	66.6% (.TXT) Text - UTF-16 (LE) encoded (2000/1) 33.3% (.MP3) MP3 audio (1000/1)
Magika	autohotkey
Reporter	threatcat_ch
Tags:	js MassLogger

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

152

Origin country :

CH

Vendor Threat Intelligence

ACCE Unknown

No detections

CyberFortress Clean

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a3cb3dc86bc95245bf95242

Tags:

n/a

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

repaired

Link:

https://www.filescan.io/uploads/6a3cb3d262d0679105ff2975/reports/f442165a-7965-4ca8-a86d-cb63fbe0af3a/overview

Hybrid Analysis Trojan.Generic

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/68aea9911a10b2b3ffc1d5b08ee110390a567de16c7cc4e3c60969752f92741b

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

First seen:

2026-06-23T18:29:00Z UTC

Last seen:

2026-06-27T03:26:00Z UTC

Hits:

~10000

Detections:

PDM:Trojan.Win32.Generic HEUR:Trojan.Script.Generic

Link:

https://opentip.kaspersky.com/68aea9911a10b2b3ffc1d5b08ee110390a567de16c7cc4e3c60969752f92741b/results?tab=lookup

Joe Sandbox MSIL Logger, MassLogger RAT

Result

Threat name:

MSIL Logger, MassLogger RAT

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1933516

Signature

.NET source code contains potential unpacker

.NET source code contains process injector

.NET source code contains very large array initializations

.NET source code references suspicious native API functions

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Contains functionality to capture screen (.Net source)

Contains functionality to log keystrokes (.Net Source)

Creates an undocumented autostart registry key

Found malware configuration

Installs a global keyboard hook

Joe Sandbox ML detected suspicious sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

WScript reads language and country specific registry keys (likely country aware script)

Yara detected MassLogger RAT

Yara detected MSIL Logger

Yara detected Telegram RAT

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/68aea9911a10b2b3ffc1d5b08ee110390a567de16c7cc4e3c60969752f92741b

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/68aea9911a10b2b3ffc1d5b08ee110390a567de16c7cc4e3c60969752f92741b/

Neiki Family.MASSLOGGER

Verdict:

Malicious

Threat:

Family.MASSLOGGER

Link:

https://tip.neiki.dev/file/68aea9911a10b2b3ffc1d5b08ee110390a567de16c7cc4e3c60969752f92741b

ReversingLabs TitaniumCloud Win32.Trojan.Malgent

Threat name:

Win32.Trojan.Malgent

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-06-24 00:03:07 UTC

File Type:

Text (JavaScript)

AV detection:

13 of 24 (54.17%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ncxktei2cczlh76b2wyi5yiqheffm7pbnr6mjy6gbfuxkl4soqnq._file

Hatching Triage masslogger

Result

Malware family:

masslogger

Alert

Create hunting rule

Score:

  10/10

Tags:

family:masslogger collection execution persistence spyware stealer

Link:

https://tria.ge/reports/260625-fg4elahv6p/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

Accesses Microsoft Outlook profiles

Command and Scripting Interpreter: PowerShell

Looks up external IP address via web service

Checks computer location settings

Registers new Windows logon scripts automatically executed at logon.

Badlisted process makes network request

Family: MassLogger

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/68aea9911a10b2b3ffc1d5b08ee110390a567de16c7cc4e3c60969752f92741b