MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bd397601204e05f715e9abef8f3d47c6fdba5600902862b0187dd12adc0f9182. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	bd397601204e05f715e9abef8f3d47c6fdba5600902862b0187dd12adc0f9182
SHA3-384 hash:	6c53d90ca7e40032a91b2e5e36b109b3b63c870e0500cc3183090a6b0d0b5a470b818f4b318cbe33c95c32233a237ab3
SHA1 hash:	879e2b925c3ecc80f888b54dccd6fdcfe28cb789
MD5 hash:	49f89db8f80af38bff5c63a2121b9ded
humanhash:	kansas-minnesota-lithium-hot
File name:	meguebestkingofinternationalkingscomingback.hta
Download:	download sample
Signature	MassLogger Alert Create hunting rule
File size:	13'970 bytes
First seen:	2025-03-21 16:42:20 UTC
Last seen:	2025-03-22 10:05:32 UTC
File type:	hta
MIME type:	text/html
ssdeep	48:3vKeHU8Nj+MHU8N14bBAkmnjZH8UpkpylbexaAaa5/adzjTAejnwHU8NYnPG:fHxNyMxNyy9jZcUmiaMli/izjTVwxNE+
Threatray	842 similar samples on MalwareBazaar
TLSH	T19E5275CD6C21BED1C38BA4310ADEF0F97C4CDF86C06210AA35ADA4995F05A2D64D55DF
Magika	html
Reporter	abuse_ch
Tags:	hta MassLogger

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

84

Origin country :

DE

Vendor Threat Intelligence

CyberFortress

Gathering data

DocGuard Malicious

Result

Verdict:

Malicious

File Type:

HTA File - Malicious

Link:

https://app.docguard.net/bd397601204e05f715e9abef8f3d47c6fdba5600902862b0187dd12adc0f9182/results/dashboard

Payload URLs

URL

File name

http://192.3.101.146/160/sihost.exe

HTA File

Behaviour

BlacklistAPI detected

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

powershell

Link:

https://www.filescan.io/uploads/67dd9733195c2ecf47ef0c6f/reports/242b3e5c-e526-4741-8967-286d171e7823/overview

Hybrid Analysis VBS.Asthma.2.1747DD69

Verdict:

Malicious

Labled as:

VBS.Asthma.2.1747DD69

Link:

https://www.hybrid-analysis.com/sample/bd397601204e05f715e9abef8f3d47c6fdba5600902862b0187dd12adc0f9182

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Base64 Encoded URL

Detected an ANSI or UNICODE http:// or https:// base64 encoded URL prefix.

Joe Sandbox Cobalt Strike, MSIL Logger, MassLogger R

Result

Threat name:

Cobalt Strike, MSIL Logger, MassLogger R

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1645374

Signature

.NET source code references suspicious native API functions

Binary is likely a compiled AutoIt script file

Contains functionality to log keystrokes (.Net Source)

Detected Cobalt Strike Beacon

Found malware configuration

Joe Sandbox ML detected suspicious sample

Loading BitLocker PowerShell Module

Malicious sample detected (through community Yara rule)

Maps a DLL or memory area into another process

Multi AV Scanner detection for submitted file

Powershell drops PE file

Sigma detected: Dot net compiler compiles file from suspicious location

Sigma detected: Files With System Process Name In Unsuspected Locations

Sigma detected: Suspicious MSHTA Child Process

Sigma detected: System File Execution Location Anomaly

Suricata IDS alerts for network traffic

Suspicious command line found

Suspicious powershell command line found

Switches to a custom stack to bypass stack traces

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Yara detected MassLogger RAT

Yara detected MSIL Logger

Yara detected Powershell decode and execute

Yara detected Telegram RAT

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/bd397601204e05f715e9abef8f3d47c6fdba5600902862b0187dd12adc0f9182

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/bd397601204e05f715e9abef8f3d47c6fdba5600902862b0187dd12adc0f9182/

ReversingLabs TitaniumCloud Script-WScript.Trojan.Asthma

Threat name:

Script-WScript.Trojan.Asthma

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-03-21 13:46:37 UTC

File Type:

Text (HTML)

Extracted files:

1

AV detection:

10 of 24 (41.67%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=xu4xmajajyc7ofpjvpxy6pkhy363uvqasaugfmaypxisvxapsgba._file

Threatray novastealer unc_loader_036

Verdict:

malicious

Label(s):

novastealer

Alert

Create hunting rule

unc_loader_036

Alert

Create hunting rule

Similar samples:

14f6cc465c16b2b06dca025ac97d6824d0793554b1599b68e401379b4f2cb12a

MassLogger

8eb955d1794fe1fd4c8e9bd91c280a69e09c11a9673c3e0fa2312a27520b3eb5

MassLogger

91a04734fb1bfa93391d961ff94dfdfffc3021d6cf56cb31f9d696aa3251c6e2

MassLogger

9d9dd06960daac5cb979cc40a22fcbe4742a2694fef52b356b4f72c9dc0b779a

MassLogger

b1e3a6d51db48a05f1d5022fd98fd544cd64af54db335e11fd229c45a6fb4a8d

MassLogger

error

MassLogger

+ 832 additional samples on MalwareBazaar

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

collection defense_evasion discovery execution

Link:

https://tria.ge/reports/250321-t8besaszet/

Behaviour

Modifies Internet Explorer settings

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Enumerates physical storage devices

System Location Discovery: System Language Discovery

AutoIT Executable

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Blocklisted process makes network request

Downloads MZ/PE file

Evasion via Device Credential Deployment

VMRay PrivateLogger

Malware family:

PrivateLogger

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/bd397601204e/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.