MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 996dc4dc82537cf5ec2fd334070a72ff4840a2394ea7f3ad722155337d988062. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	996dc4dc82537cf5ec2fd334070a72ff4840a2394ea7f3ad722155337d988062
SHA3-384 hash:	0a950a6b291774baa37e18f0caa6b9286e7aecafd61f024ec97e308755e5333c06f103c51135e12a488ee355b9a0194c
SHA1 hash:	faf871a949b984854263324946eb69656ce71275
MD5 hash:	a7bf8c3d79f84f164c7fd586df0311a0
humanhash:	purple-one-ceiling-delta
File name:	EKSTRE - 1244.vbe
Download:	download sample
Signature	MassLogger Alert Create hunting rule
File size:	1'303'532 bytes
First seen:	2025-12-10 05:40:52 UTC
Last seen:	Never
File type:	vbe
MIME type:	application/octet-stream
ssdeep	24576:VmVYSmZDjwX0D9eg9X8wfDJfnBKIyMyt6LtLUaGtt+p:e2
TLSH	T1A255F25D4061ADC2A004FEF0F541AFA7CCDB5798122746121FE168AD6322D83FFAB6E5
TrID	66.6% (.TXT) Text - UTF-16 (LE) encoded (2000/1) 33.3% (.MP3) MP3 audio (1000/1)
Magika	vba
Reporter	abuse_ch
Tags:	MassLogger vbe

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

57

Origin country :

SE

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.VBS.Encrypted.Gen.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

94.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=69390814bde6a3e5970fac3d

Tags:

obfuscate xtreme shell

Hybrid Analysis VBS/Agent.TEM trojan

Verdict:

Malicious

Labled as:

VBS/Agent.TEM trojan

Link:

https://www.hybrid-analysis.com/sample/996dc4dc82537cf5ec2fd334070a72ff4840a2394ea7f3ad722155337d988062

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

vbe

First seen:

2025-12-09T08:04:00Z UTC

Last seen:

2025-12-12T03:27:00Z UTC

Hits:

~1000

Detections:

HEUR:Trojan.VBS.Agent.gen HEUR:Trojan.Script.Generic Trojan-Dropper.Win32.Agent.sb Trojan-Downloader.JS.SLoad.sb Trojan-Downloader.JS.Cryptoload.sb Trojan.VBS.SAgent.sb Trojan.JS.SAgent.sb HEUR:Trojan-Downloader.Script.Generic

Link:

https://opentip.kaspersky.com/996dc4dc82537cf5ec2fd334070a72ff4840a2394ea7f3ad722155337d988062/results?tab=lookup

Joe Sandbox MSIL Logger, MassLogger RAT

Result

Threat name:

MSIL Logger, MassLogger RAT

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1830014

Signature

.NET source code contains potential unpacker

.NET source code references suspicious native API functions

Contains functionality to log keystrokes (.Net Source)

Found malware configuration

Injects a PE file into a foreign processes

Joe Sandbox ML detected suspicious sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: HackTool - CrackMapExec PowerShell Obfuscation

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: WScript or CScript Dropper

Sigma detected: WScript or CScript Dropper - File

Suspicious execution chain found

Suspicious powershell command line found

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Windows Shell Script Host drops VBS files

Writes or reads registry keys via WMI

Writes registry values via WMI

Writes to foreign memory regions

Wscript starts Powershell (via cmd or directly)

Yara detected MassLogger RAT

Yara detected MSIL Logger

Yara detected Telegram RAT

Behaviour

Behavior Graph:

Download SVG

Malva.RE Malware

Verdict:

Malware

YARA:

1 match(es)

Tags:

DeObfuscated Obfuscated T1059.005 VBScript VBScript Encoded

Link:

https://app.malva.re/file/a7bf8c3d79f84f164c7fd586df0311a0

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/996dc4dc82537cf5ec2fd334070a72ff4840a2394ea7f3ad722155337d988062/

Neiki Trojan-Downloader.JS.SLoad

Verdict:

Malicious

Threat:

Trojan-Downloader.JS.SLoad

Link:

https://tip.neiki.dev/file/996dc4dc82537cf5ec2fd334070a72ff4840a2394ea7f3ad722155337d988062

ReversingLabs TitaniumCloud Win32.Trojan.Kepavll

Threat name:

Win32.Trojan.Kepavll

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-12-09 14:23:48 UTC

File Type:

Binary

AV detection:

7 of 24 (29.17%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=tfw4jxeckn6pl3bp2m2aocts75eebirzj2t7hllsefktg7myqbra._file

Hatching Triage masslogger

Result

Malware family:

masslogger

Alert

Create hunting rule

Score:

  10/10

Tags:

family:masslogger collection discovery execution persistence spyware stealer

Link:

https://tria.ge/reports/251210-gdms4svkcv/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

outlook_office_path

outlook_win_path

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Checks computer location settings

Command and Scripting Interpreter: PowerShell

MassLogger

Masslogger family

VMRay PrivateLogger

Malware family:

PrivateLogger

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/996dc4dc8253/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/996dc4dc82537cf5ec2fd334070a72ff4840a2394ea7f3ad722155337d988062