MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b44919b1f152b7bc2e2629abc664cce2ee7abc297ca3e5faababa4dfae6f9f49. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	b44919b1f152b7bc2e2629abc664cce2ee7abc297ca3e5faababa4dfae6f9f49
SHA3-384 hash:	59b113c7086b01c173f49fc4cedec420986a4d8b618c5704cd990e5afc665deade832efa9d6e2ac40a296e392dc3a62e
SHA1 hash:	0aa7681b7cbaca2f0445197c9e13ac4f5d252800
MD5 hash:	17756f152d77af6985be797950c3d947
humanhash:	yellow-apart-september-juliet
File name:	RFQ- PR 115322 NBP SQD700 INV.973G.js
Download:	download sample
Signature	MassLogger Alert Create hunting rule
File size:	781'216 bytes
First seen:	2026-06-11 06:31:16 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	3072:E2J0uWO7eFQB3G9i2L0vFCV1PortM78K2DUnRFXnOk7N8RNkYwD9P3zDpqHFVnrN:UhiH
Threatray	1'576 similar samples on MalwareBazaar
TLSH	T162F4083DCC64413EE032C619C996055FF8925A1B222CED0B60C73B9BAE7398677D729D
TrID	66.6% (.TXT) Text - UTF-16 (LE) encoded (2000/1) 33.3% (.MP3) MP3 audio (1000/1)
Magika	txt
Reporter	threatcat_ch
Tags:	js MassLogger

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

143

Origin country :

CH

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.JS.Starter.169.24238.21173.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

90.2%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a2a564da15110463ee4af72

Tags:

agenttesla obfuscate shell virus

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

masquerade repaired

Link:

https://www.filescan.io/uploads/6a2a5645554e843ff8680683/reports/bb49f276-4e15-4202-8e6b-11ba7b6fac6a/overview

Hybrid Analysis Generik.HQKIQGI trojan

Verdict:

Malicious

Labled as:

Generik.HQKIQGI trojan

Link:

https://www.hybrid-analysis.com/sample/b44919b1f152b7bc2e2629abc664cce2ee7abc297ca3e5faababa4dfae6f9f49

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

First seen:

2026-06-10T16:39:00Z UTC

Last seen:

2026-06-11T03:35:00Z UTC

Hits:

~1000

Detections:

PDM:Trojan.Win32.Generic HEUR:Trojan-Downloader.Script.Generic HEUR:Trojan.Script.Generic

Link:

https://opentip.kaspersky.com/b44919b1f152b7bc2e2629abc664cce2ee7abc297ca3e5faababa4dfae6f9f49/results?tab=lookup

Joe Sandbox MSIL Logger, MassLogger RAT

Result

Threat name:

MSIL Logger, MassLogger RAT

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1926382

Signature

.NET source code references suspicious native API functions

Contains functionality to capture screen (.Net source)

Contains functionality to log keystrokes (.Net Source)

Creates an undocumented autostart registry key

Encrypted powershell cmdline option found

Found malware configuration

Joe Sandbox ML detected suspicious sample

JScript performs obfuscated calls to suspicious functions

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Potential dropper URLs found in powershell memory

Sigma detected: WScript or CScript Dropper

Suricata IDS alerts for network traffic

Suspicious execution chain found

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

WScript reads language and country specific registry keys (likely country aware script)

Yara detected MassLogger RAT

Yara detected MSIL Logger

Yara detected Telegram RAT

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Susipicious

Score:

65%

Verdict:

Susipicious

File Type:

SCRIPT

Link:

https://malprob.io/report/b44919b1f152b7bc2e2629abc664cce2ee7abc297ca3e5faababa4dfae6f9f49

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/b44919b1f152b7bc2e2629abc664cce2ee7abc297ca3e5faababa4dfae6f9f49/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=wrertmprkk33ylrgfgv4mzgm4lxhvpbjpsr6l6vlvosn7ltpt5eq._file

Threatray novastealer

Verdict:

malicious

Label(s):

novastealer

Alert

Create hunting rule

Similar samples:

018fe5bd0c2101c546959da962776443c83e5ed6f7c9d5aaf621ddde3e985904

MassLogger

3e5b5bc7054d240c93904e71e7934261057636152a3f95292b325a7d0442b884

MassLogger

41f13693681cc7e8b773cae573f5e1bcbacbadbb0d271623b241baab64a3a43c

MassLogger

5eb94225a7d4d5aff1fbea4c97e210ddbebf6f09365f658a5571f7d6b8e0da5c

MassLogger

78c375d37aeceb5da37845f1f9a499c7a17390f686fe1ff7895cff41931e9ef3

MassLogger

7b13d7f29b1baf4deb469eb9b8ba3ed64061dc8614de31e5b04e272fdc4de900

MassLogger

ae7ba52112fa966df1b3c42592f870f9106edcb3f0f3cf36f1377b6a8e41bb19

MassLogger

ea3e8c3eb86640176f6ce63394d49aaa7c172bb1894aa4e73c3009eec29a212f

MassLogger

error

MassLogger

fb8a28149cfb7b73aba293a376165db94c3c2b4bffe59965997cc8978ae15686

MassLogger

+ 1'566 additional samples on MalwareBazaar

Hatching Triage masslogger

Result

Malware family:

masslogger

Alert

Create hunting rule

Score:

  10/10

Tags:

family:masslogger collection defense_evasion execution persistence spyware stealer

Link:

https://tria.ge/reports/260611-hab3waa15r/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Obfuscated Files or Information: Command Obfuscation

Checks computer location settings

Registers new Windows logon scripts automatically executed at logon.

Badlisted process makes network request

Downloads MZ/PE file

Family: MassLogger

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/b44919b1f152b7bc2e2629abc664cce2ee7abc297ca3e5faababa4dfae6f9f49