MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b5add4b2a280e4e59eea05f553833a0e9a314a76106dd7c346a4b37b2255ae73. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	b5add4b2a280e4e59eea05f553833a0e9a314a76106dd7c346a4b37b2255ae73
SHA3-384 hash:	7fc09620af6b3662de48c0c3585942c05fcbfe2ccd83bb280d5840d1b3155496116064002d510b0389d717dc30b26254
SHA1 hash:	ac9501ae42dc7acf579267be3229b7dc7892d38e
MD5 hash:	1de837528342f67817072c3080ec8c9f
humanhash:	high-hydrogen-zebra-magnesium
File name:	QUOTATION REQUEST-DTC-9-PQD-0137.JS
Download:	download sample
Signature	MassLogger Alert Create hunting rule
File size:	4'410'284 bytes
First seen:	2026-06-30 05:46:29 UTC
Last seen:	2026-06-30 07:50:49 UTC
File type:	js
MIME type:	text/plain
ssdeep	98304:CO8PgQdmgTNM24aZ1/oIyzQnnePoH4M406sNMkVbtO8PgQdmgTNM24aZ1/oIyzQS:CNP//ka3LyEeP04h6NP//ka3LyEePF
Threatray	411 similar samples on MalwareBazaar
TLSH	T1E516065457A6A1337320EB9D513AEE38540EA00369DACF04356EE728792CE57A35CFE3
Magika	javascript
Reporter	lowmal3
Tags:	js MassLogger

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

128

Origin country :

DE

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

Sanesecurity.Malware.31320.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

96.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a4358731548daf709fb287b

Tags:

backdoor virus blic

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-debug downloader dropper evasive formbook obfuscated obfuscated packed repaired

Link:

https://www.filescan.io/uploads/6a43586cce38fd6f98b1bc53/reports/c92a8737-5c01-4c8c-b911-0360d405468d/overview

Hybrid Analysis JS_TrojanDropper_Agent_PUC_trojan

Verdict:

Malicious

Labled as:

JS_TrojanDropper_Agent_PUC_trojan

Link:

https://www.hybrid-analysis.com/sample/b5add4b2a280e4e59eea05f553833a0e9a314a76106dd7c346a4b37b2255ae73

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

First seen:

2026-06-29T13:14:00Z UTC

Last seen:

2026-06-30T02:44:00Z UTC

Hits:

~1000

Link:

https://opentip.kaspersky.com/b5add4b2a280e4e59eea05f553833a0e9a314a76106dd7c346a4b37b2255ae73/results?tab=lookup

Joe Sandbox DonutLoader, MSIL Logger, MassLogger RAT

Result

Threat name:

DonutLoader, MSIL Logger, MassLogger RAT

Alert

Create hunting rule

Detection:

malicious

Classification:

evad.troj.spyw

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1935369

Signature

.NET source code references suspicious native API functions

Benign windows process drops PE files

Contains functionality to capture screen (.Net source)

Contains functionality to log keystrokes (.Net Source)

Drops PE files to the document folder of the user

Drops PE files with a suspicious file extension

Found malware configuration

Hides threads from debuggers

Joe Sandbox ML detected suspicious sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sigma detected: WScript or CScript Dropper

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Unusual module load detection (module proxying)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

WScript reads language and country specific registry keys (likely country aware script)

Yara detected DonutLoader

Yara detected MassLogger RAT

Yara detected MSIL Logger

Yara detected Telegram RAT

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

95%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/b5add4b2a280e4e59eea05f553833a0e9a314a76106dd7c346a4b37b2255ae73

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/b5add4b2a280e4e59eea05f553833a0e9a314a76106dd7c346a4b37b2255ae73/

Neiki Family.DONUTLOADER

Verdict:

Malicious

Threat:

Family.DONUTLOADER

Link:

https://tip.neiki.dev/file/b5add4b2a280e4e59eea05f553833a0e9a314a76106dd7c346a4b37b2255ae73

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=www5jmvcqdsolhxkax2vhaz2b2ndcstwcbw5pq2guszxwisvvzzq._file

Threatray novastealer

Verdict:

malicious

Label(s):

novastealer

Alert

Create hunting rule

Similar samples:

09eb254ca162965a3722fd345476cbbacbd46e7d6d27632c4ce8ae614c961a2d

MassLogger

153a492ed524469bc8fd9a9fcd4d0ec3215caa4b0bb1e34bd779fad17271b56a

MassLogger

6f8c26cc1096a3d10169efc5a2eba3f0370b905b3322b839e9af3bcbad540748

MassLogger

8be9560f26392b4e905203d1464ab7e6bb17c0091b3a346fa443867b6b9d8e41

MassLogger

8dffead0450847a53d2c7d585aa2150acc44a4813ecbd31f0e7f6c61d7b08c05

MassLogger

b271d12f4da306da079d7592f4611ffbd1f4c0a10f62031fc1d96a259728f96d

MassLogger

dc12faa460faab18a12d8ac33fb3a3a96c95232cff2f124df15300475cc20486

MassLogger

e378354b49d513292c0c6cb4b733dd5b3bf64fd4d706830b0fb1ab2a158a6b86

MassLogger

error

MassLogger

fa74415147a3f022e754f3450a8d25f9ee01d54ed29c9f882c4c321f09a484bf

MassLogger

+ 401 additional samples on MalwareBazaar

Hatching Triage masslogger

Result

Malware family:

masslogger

Alert

Create hunting rule

Score:

  10/10

Tags:

family:masslogger collection discovery execution spyware stealer

Link:

https://tria.ge/reports/260630-gg3zhafw5w/

Behaviour

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of NtSetInformationThreadHideFromDebugger

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Checks computer location settings

Executes dropped EXE

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Family: MassLogger

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.55

Link:

https://yomi.yoroi.company/submissions/b5add4b2a280e4e59eea05f553833a0e9a314a76106dd7c346a4b37b2255ae73