MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 89db717a676cfc03ee69c3506ee808145d644bfc6149b87edfe742c4e18ad487. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	89db717a676cfc03ee69c3506ee808145d644bfc6149b87edfe742c4e18ad487
SHA3-384 hash:	90caa466406cbfd5466cef9433f216364b171f3c8ac28f30b10400ecdb64d96cb2ce791faebe768f03b252a209371f56
SHA1 hash:	0df6429bd26afb4ad2746d7f450d51423b7bb9a4
MD5 hash:	c5f4f8f1250ce774c106a531d4166ebd
humanhash:	pasta-missouri-hydrogen-massachusetts
File name:	Nueva orden de compra.js
Download:	download sample
Signature	MassLogger Alert Create hunting rule
File size:	4'029'550 bytes
First seen:	2026-06-18 05:50:42 UTC
Last seen:	2026-06-18 05:53:03 UTC
File type:	js
MIME type:	text/plain
ssdeep	3072:OSrFoSuU4OOGdQpNBh6BE8oIlV30HRkTCzVAp4E9wS0XqlYdq0eVy4knx+ek938/:ROGOzxkQS0OH3SnviuH
Threatray	1'597 similar samples on MalwareBazaar
TLSH	T1B716D53CCD58413EEAB2D918C8D9491FF4922597222DD94B90CB2F5F5E23983B7D221E
TrID	66.6% (.TXT) Text - UTF-16 (LE) encoded (2000/1) 33.3% (.MP3) MP3 audio (1000/1)
Magika	txt
Reporter	lowmal3
Tags:	js MassLogger

Intelligence

---

File Origin

# of uploads :

3

# of downloads :

159

Origin country :

DE

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.JS.Obfus-2662.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Clean

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a33874d1a97308eef89fe7a

Tags:

n/a

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

base64 conhost obfuscated powershell repaired

Link:

https://www.filescan.io/uploads/6a338746a419cb85d28c7eb5/reports/a764aac0-fabf-4ffe-9da2-9994e7a2e651/overview

Hybrid Analysis JS/Agent.UTP trojan

Verdict:

Malicious

Labled as:

JS/Agent.UTP trojan

Link:

https://www.hybrid-analysis.com/sample/89db717a676cfc03ee69c3506ee808145d644bfc6149b87edfe742c4e18ad487

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

First seen:

2026-06-17T12:44:00Z UTC

Last seen:

2026-06-20T02:39:00Z UTC

Hits:

~10000

Detections:

PDM:Trojan.Win32.Generic HEUR:Trojan.Script.Generic

Link:

https://opentip.kaspersky.com/89db717a676cfc03ee69c3506ee808145d644bfc6149b87edfe742c4e18ad487/results?tab=lookup

Joe Sandbox MSIL Logger, MassLogger RAT

Result

Threat name:

MSIL Logger, MassLogger RAT

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1929745

Signature

.NET source code references suspicious native API functions

Contains functionality to log keystrokes (.Net Source)

Creates an undocumented autostart registry key

Encrypted powershell cmdline option found

Found malware configuration

Joe Sandbox ML detected suspicious sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

WScript reads language and country specific registry keys (likely country aware script)

Yara detected MassLogger RAT

Yara detected MSIL Logger

Yara detected Telegram RAT

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Susipicious

Score:

51%

Verdict:

Susipicious

File Type:

SCRIPT

Link:

https://malprob.io/report/89db717a676cfc03ee69c3506ee808145d644bfc6149b87edfe742c4e18ad487

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/89db717a676cfc03ee69c3506ee808145d644bfc6149b87edfe742c4e18ad487/

Neiki Family.MASSLOGGER

Verdict:

Malicious

Threat:

Family.MASSLOGGER

Link:

https://tip.neiki.dev/file/89db717a676cfc03ee69c3506ee808145d644bfc6149b87edfe742c4e18ad487

ReversingLabs TitaniumCloud Win32.Trojan.Redirector

Threat name:

Win32.Trojan.Redirector

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-06-17 15:54:58 UTC

File Type:

Text (JavaScript)

AV detection:

10 of 24 (41.67%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=rhnxc6thnt6ah3tjynig52aicrowis74mfe3q7w745bmjymk2sdq._file

Threatray novastealer

Verdict:

malicious

Label(s):

novastealer

Alert

Create hunting rule

Similar samples:

018fe5bd0c2101c546959da962776443c83e5ed6f7c9d5aaf621ddde3e985904

MassLogger

063f4715cbacd71b07e2bc0a7f47d5e859e081c2dd9182f32cbbf39938095edf

MassLogger

18daef9e3e931cc07c146562f97d64bc5257672d38b17a45cc619b03865840ec

MassLogger

1f49effe122ada5b31856c5f3f9a230786fc267f65527fe9199820aa6e547237

MassLogger

3e5b5bc7054d240c93904e71e7934261057636152a3f95292b325a7d0442b884

MassLogger

5fb1c4c9d36019fa85b4927e66306309e360445283a272ace5296d43c841dec7

MassLogger

6cd900620e1ca921c028ad02e78e082d90351ec2a96c34ac532249f5fea16c3a

MassLogger

af1e4e322e5b463174febf86b0f8503ce89385dfc94671de61ece1f1c92a9065

MassLogger

error

MassLogger

fb8a28149cfb7b73aba293a376165db94c3c2b4bffe59965997cc8978ae15686

MassLogger

+ 1'587 additional samples on MalwareBazaar

Hatching Triage masslogger

Result

Malware family:

masslogger

Alert

Create hunting rule

Score:

  10/10

Tags:

family:masslogger collection defense_evasion execution persistence spyware stealer

Link:

https://tria.ge/reports/260618-gj4ntae18n/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Obfuscated Files or Information: Command Obfuscation

Checks computer location settings

Registers new Windows logon scripts automatically executed at logon.

Badlisted process makes network request

Family: MassLogger

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/89db717a676cfc03ee69c3506ee808145d644bfc6149b87edfe742c4e18ad487