MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d6294c7f1439ef9b847576f054cbbefaa6ebb41aabec1cec88453ed3bbad84f3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	d6294c7f1439ef9b847576f054cbbefaa6ebb41aabec1cec88453ed3bbad84f3
SHA3-384 hash:	cfee7b97e18108e4c92bfbd4aafccc4a1483a3ec052ea559d0962608ff74107c21cbf5b4eb40136240edbcb0852405d6
SHA1 hash:	2dd3d4c0ff2515dac1d752844b78ab04bf054d21
MD5 hash:	f668e2640e9e3c2c4a71ff6e2fc384d2
humanhash:	muppet-paris-glucose-failed
File name:	ORDEN DE COMPRAS.js
Download:	download sample
Signature	MassLogger Alert Create hunting rule
File size:	1'539'068 bytes
First seen:	2026-07-22 06:30:29 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	12288:rMjVNMHs5YeYrAAaqzY3RfPvbOJz6SIqyBP8v:wjVNMsXYrA9q83RHjOJ+1pP8v
TLSH	T1DB655B34B29A766EF9364A0E41BB413287171730ED38504D174E83B7A9DF548E7EABC2
TrID	66.6% (.TXT) Text - UTF-16 (LE) encoded (2000/1) 33.3% (.MP3) MP3 audio (1000/1)
Magika	html
Reporter	lowmal3
Tags:	js MassLogger

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

156

Origin country :

DE

Vendor Threat Intelligence

ACCE Unknown

No detections

CyberFortress Malicious

Verdict:

Malicious

Score:

90.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a6063adbcffb2c48cb7c996

Tags:

stration shell sage

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

cmd conhost expand lolbin powershell repaired

Link:

https://www.filescan.io/uploads/6a6063a4a49b7e7a1132db59/reports/a659be67-6251-4ca2-b7ae-d89309f3962f/overview

Hybrid Analysis VBS/Obfuscated.G trojan

Verdict:

Malicious

Labled as:

VBS/Obfuscated.G trojan

Link:

https://www.hybrid-analysis.com/sample/d6294c7f1439ef9b847576f054cbbefaa6ebb41aabec1cec88453ed3bbad84f3

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

First seen:

2026-07-21T12:37:00Z UTC

Last seen:

2026-07-22T03:11:00Z UTC

Hits:

~10000

Link:

https://opentip.kaspersky.com/d6294c7f1439ef9b847576f054cbbefaa6ebb41aabec1cec88453ed3bbad84f3/results?tab=lookup

Joe Sandbox MSIL Logger, MassLogger RAT

Result

Threat name:

MSIL Logger, MassLogger RAT

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1946286

Signature

.NET source code references suspicious native API functions

Contains functionality to log keystrokes (.Net Source)

Creates an undocumented autostart registry key

Found malware configuration

Joe Sandbox ML detected suspicious sample

JScript performs obfuscated calls to suspicious functions

Malicious sample detected (through community Yara rule)

Sigma detected: PowerShell Base64 Encoded IEX Cmdlet

Sigma detected: WScript or CScript Dropper

Suricata IDS alerts for network traffic

Suspicious command line found

Suspicious execution chain found

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

WScript reads language and country specific registry keys (likely country aware script)

Yara detected MassLogger RAT

Yara detected MSIL Logger

Yara detected Telegram RAT

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

5%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/d6294c7f1439ef9b847576f054cbbefaa6ebb41aabec1cec88453ed3bbad84f3

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/d6294c7f1439ef9b847576f054cbbefaa6ebb41aabec1cec88453ed3bbad84f3/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=2yuuy7yuhhxzxbdvo3yfjs567ktoxna2vpwbz3eiiu7nho5nqtzq._file

Threatray NovaStealer

Verdict:

malicious

Label(s):

NovaStealer

Alert

Create hunting rule

Link:

https://reports.threatray.com/6e0d2f84-264d-46af-b558-f5cf75f799c0

Similar samples:

018fe5bd0c2101c546959da962776443c83e5ed6f7c9d5aaf621ddde3e985904

MassLogger

1f49effe122ada5b31856c5f3f9a230786fc267f65527fe9199820aa6e547237

MassLogger

3e5b5bc7054d240c93904e71e7934261057636152a3f95292b325a7d0442b884

MassLogger

78c375d37aeceb5da37845f1f9a499c7a17390f686fe1ff7895cff41931e9ef3

MassLogger

7b13d7f29b1baf4deb469eb9b8ba3ed64061dc8614de31e5b04e272fdc4de900

MassLogger

b44919b1f152b7bc2e2629abc664cce2ee7abc297ca3e5faababa4dfae6f9f49

MassLogger

ea3e8c3eb86640176f6ce63394d49aaa7c172bb1894aa4e73c3009eec29a212f

MassLogger

fb8a28149cfb7b73aba293a376165db94c3c2b4bffe59965997cc8978ae15686

MassLogger

Hatching Triage masslogger

Result

Malware family:

masslogger

Alert

Create hunting rule

Score:

  10/10

Tags:

family:masslogger collection execution persistence spyware stealer

Link:

https://tria.ge/reports/260722-g9z4baw1bw/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

Executes a command shell one-liner

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Checks computer location settings

Registers new Windows logon scripts automatically executed at logon.

Badlisted process makes network request

Downloads MZ/PE file

Family: MassLogger

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/d6294c7f1439ef9b847576f054cbbefaa6ebb41aabec1cec88453ed3bbad84f3