MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6a9f2a5a20ba051e1bd0eb9c09a61842e200c126f372d91d5e70da336f7e52a8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6a9f2a5a20ba051e1bd0eb9c09a61842e200c126f372d91d5e70da336f7e52a8
SHA3-384 hash: 890feae40edbaf9446bed8281cd452257d91d250a3da13dd5b615aa4ac81438ab5915e8890586b23a6ffed8838d832b1
SHA1 hash: e3d2140cad055e67b7839cbf5ea91e38feeb735f
MD5 hash: a33875df7d8ef06864729ce9a8370dc6
humanhash: alpha-floor-equal-connecticut
File name:RECIBO DE PAGO.js
Download: download sample
Signature MassLogger
Create hunting rule
File size:2'792'924 bytes
First seen:2026-08-20 02:24:00 UTC
Last seen:Never
File type:Java Script (JS) js
MIME type:text/plain
ssdeep 24576:PtMFlE47eC6t25S3JvShX03KxhiNpJt5gKknUmjgqMNynU85CoSII4yhlDQeglVc:6GkQLcSITLtKzLxdPtRpJ
TLSH T117D51FA91D47336D602CA38EC74565B0662DBF1A5F8F0A0D036DC6AC4BB3058E197DEE
TrID 66.6% (.TXT) Text - UTF-16 (LE) encoded (2000/1)
33.3% (.MP3) MP3 audio (1000/1)
Magika vba
Reporter threatcat_ch
Tags:js MassLogger

Intelligence

File Origin
# of uploads :
1
# of downloads :
163
Origin country :
CH CH
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.81113209.25074.21322.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
aes base64 base64 conhost crypto evasive lolbin obfuscated overlay persistence powershell repaired wscript
Link:
https://www.filescan.io/uploads/6a86655d89b109c80f44a917/reports/55083dca-24f4-4df9-9dc7-442a927c9f41/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/6a9f2a5a20ba051e1bd0eb9c09a61842e200c126f372d91d5e70da336f7e52a8
Result
Threat name:
MSIL Logger, MassLogger RAT
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1960850
Signature
AI detected malicious Powershell script
Bypasses PowerShell execution policy
Found malware configuration
JScript performs obfuscated calls to suspicious functions
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Potential evasive JS / VBS script found (domain check)
Sigma detected: Script Interpreter Execution From Suspicious Folder
Sigma detected: Suspicious PowerShell Parameter Substring
Sigma detected: Suspicious Script Execution From Temp Folder
Sigma detected: WScript or CScript Dropper
Sigma detected: WScript or CScript Dropper - File
Suspicious powershell command line found
Tries to detect the country of the analysis system (by using the IP)
Tries to harvest and steal browser information (history, passwords, etc)
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Wscript called in batch mode (surpress errors)
Yara detected MassLogger RAT
Yara detected MSIL Logger
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1960850 Sample: RECIBO DE PAGO.js Startdate: 20/08/2026 Architecture: WINDOWS Score: 100 31 reallyfreegeoip.org 2->31 33 mail.arfat.com.mx 2->33 35 3 other IPs or domains 2->35 43 Found malware configuration 2->43 45 Malicious sample detected (through community Yara rule) 2->45 47 Multi AV Scanner detection for submitted file 2->47 51 12 other signatures 2->51 6 wscript.exe 1 7 2->6         started        10 wscript.exe 4 2->10         started        12 powershell.exe 15 2->12         started        14 powershell.exe 14 16 2->14         started        signatures3 49 Tries to detect the country of the analysis system (by using the IP) 31->49 process4 dnsIp5 17 C:\Users\user\AppData\Local\...\1vjomt0xiyb6b, ASCII 6->17 dropped 19 C:\Users\user\AppData\Local\...\1vjomt0xiyb6a, ASCII 6->19 dropped 21 C:\Users\user\AppData\...\1vjomt0xiyb6.ps1, ASCII 6->21 dropped 23 C:\Users\user\AppData\...\PhotoStudio.js, Unicode 6->23 dropped 53 JScript performs obfuscated calls to suspicious functions 6->53 55 Windows Scripting host queries suspicious COM object (likely to drop second stage) 6->55 57 Potential evasive JS / VBS script found (domain check) 6->57 25 C:\Users\user\AppData\Local\...\149imt0xj82xb, ASCII 10->25 dropped 27 C:\Users\user\AppData\Local\...\149imt0xj82xa, ASCII 10->27 dropped 29 C:\Users\user\AppData\...\149imt0xj82x.ps1, ASCII 10->29 dropped 59 Tries to harvest and steal browser information (history, passwords, etc) 12->59 37 arfat.com.mx 198.136.58.90, 25 DIMENOC-HostDimecomIncUS United States 14->37 39 checkip.dyndns.com 193.122.6.168, 49757, 49760, 49762 ORACLE-BMC-31898-OracleCorporationUS Germany 14->39 41 reallyfreegeoip.org 104.21.67.152, 443, 49758, 49763 CLOUDFLARENET-CloudflareIncUS Canada 14->41 file6 signatures7
Score:
98%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/6a9f2a5a20ba051e1bd0eb9c09a61842e200c126f372d91d5e70da336f7e52a8
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6a9f2a5a20ba051e1bd0eb9c09a61842e200c126f372d91d5e70da336f7e52a8/
Threat name:
Script-JS.Trojan.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2026-08-18 14:33:08 UTC
AV detection:
7 of 38 (18.42%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=nkpsuwraxicr4g6q5ooatjqyilrabqjg6nznshk6odndg336kkua._file
Result
Malware family:
masslogger
Create hunting rule
Score:
  10/10
Tags:
family:masslogger collection discovery execution persistence spyware stealer
Link:
https://tria.ge/reports/260820-cvzrsadn5s/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
outlook_office_path
outlook_win_path
Command and Scripting Interpreter: JavaScript
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Badlisted process makes network request
Command and Scripting Interpreter: PowerShell
Family: MassLogger
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.95
Link:
https://yomi.yoroi.company/submissions/6a9f2a5a20ba051e1bd0eb9c09a61842e200c126f372d91d5e70da336f7e52a8

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

Java Script (JS) js 6a9f2a5a20ba051e1bd0eb9c09a61842e200c126f372d91d5e70da336f7e52a8

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments