MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d6c68cc013c7ec14d71aa4cdeedb0602e58fb3938a0bb34c886630f84ff89f0e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	d6c68cc013c7ec14d71aa4cdeedb0602e58fb3938a0bb34c886630f84ff89f0e
SHA3-384 hash:	8908a4d8129938406e1090ead8b83faa96d341871612dc8ffff737c4c5253340b722ae2fc7528923a0448fd461002f90
SHA1 hash:	ba4ca754ecebc5976ff60f440f494946ec4f1ad0
MD5 hash:	7be10b48df649c0720116bc1bb178dec
humanhash:	kentucky-muppet-don-ack
File name:	niceworkingskillwithbestideasevermade.hta
Download:	download sample
Signature	MassLogger Alert Create hunting rule
File size:	14'710 bytes
First seen:	2025-03-11 08:01:37 UTC
Last seen:	2025-03-20 08:59:46 UTC
File type:	hta
MIME type:	text/html
ssdeep	48:3PY9z8kCUKsKDH79zKQvkCUKsKDHtkAsALwPer99DdxIKe/neA5G89z8H9z9HJJX:/mzgRzN5sQwgfoj/3fzszu1zl+
TLSH	T12662A7CE1FB4FD074B45A29916CC49E5A6AC973B00541B68321C949B674EA3EDCFD483
Magika	html
Reporter	abuse_ch
Tags:	198-12-89-24 hta MassLogger

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

76

Origin country :

DE

Vendor Threat Intelligence

CyberFortress Malicious

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67cff70e1f777fe30608dd6d

Tags:

autoit emotet

DocGuard Malicious

Result

Verdict:

Malicious

File Type:

HTA File - Malicious

Link:

https://app.docguard.net/d6c68cc013c7ec14d71aa4cdeedb0602e58fb3938a0bb34c886630f84ff89f0e/results/dashboard

Payload URLs

URL

File name

http://198.12.89.24/123/casse.exe

HTA File

Behaviour

BlacklistAPI detected

Hybrid Analysis VBS.Asthma.2.8713137C

Verdict:

Malicious

Labled as:

VBS.Asthma.2.8713137C

Link:

https://www.hybrid-analysis.com/sample/d6c68cc013c7ec14d71aa4cdeedb0602e58fb3938a0bb34c886630f84ff89f0e

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Base64 Encoded URL

Detected an ANSI or UNICODE http:// or https:// base64 encoded URL prefix.

Joe Sandbox Cobalt Strike, MSIL Logger, MassLogger R

Result

Threat name:

Cobalt Strike, MSIL Logger, MassLogger R

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1635004

Signature

.NET source code references suspicious native API functions

Antivirus detection for dropped file

Antivirus detection for URL or domain

Binary is likely a compiled AutoIt script file

Contains functionality to log keystrokes (.Net Source)

Detected Cobalt Strike Beacon

Found malware configuration

Joe Sandbox ML detected suspicious sample

Loading BitLocker PowerShell Module

Malicious sample detected (through community Yara rule)

Maps a DLL or memory area into another process

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

PowerShell case anomaly found

Powershell drops PE file

Sigma detected: Dot net compiler compiles file from suspicious location

Sigma detected: Suspicious MSHTA Child Process

Suricata IDS alerts for network traffic

Suspicious command line found

Suspicious powershell command line found

Switches to a custom stack to bypass stack traces

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Yara detected MassLogger RAT

Yara detected MSIL Logger

Yara detected Powershell decode and execute

Yara detected Telegram RAT

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/d6c68cc013c7ec14d71aa4cdeedb0602e58fb3938a0bb34c886630f84ff89f0e

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/d6c68cc013c7ec14d71aa4cdeedb0602e58fb3938a0bb34c886630f84ff89f0e/

ReversingLabs TitaniumCloud Script-WScript.Trojan.Asthma

Threat name:

Script-WScript.Trojan.Asthma

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-03-10 14:45:26 UTC

File Type:

Text (HTML)

Extracted files:

1

AV detection:

8 of 24 (33.33%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=23dizqaty7wbjvy2utg65wygalsy7m4trif3gteimyypqt7yt4ha._file

Threatray novastealer unc_loader_036

Verdict:

malicious

Label(s):

novastealer

Alert

Create hunting rule

unc_loader_036

Alert

Create hunting rule

Similar samples:

error

MassLogger

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

collection defense_evasion discovery execution

Link:

https://tria.ge/reports/250311-jxchlaxzcs/

Behaviour

Modifies Internet Explorer settings

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Enumerates physical storage devices

System Location Discovery: System Language Discovery

AutoIT Executable

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Blocklisted process makes network request

Downloads MZ/PE file

Evasion via Device Credential Deployment

VMRay Malicious

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/d6c68cc013c7/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/d6c68cc013c7ec14d71aa4cdeedb0602e58fb3938a0bb34c886630f84ff89f0e