MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dc89f1981a7cc11ca6074aec4c09e0a1154d31474a0f51a5e5d57153741a00bd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	dc89f1981a7cc11ca6074aec4c09e0a1154d31474a0f51a5e5d57153741a00bd
SHA3-384 hash:	5bd517217a60e2fffbeeb58aabe6c74bafe769f72e53754228a56ab1020b263950a668e8ea6755801bedbbfb97d4517d
SHA1 hash:	119055dbb494e7a892046f5bcbfbc45a14235135
MD5 hash:	f4fa8d5666ebd448b0d0a96bc2da001a
humanhash:	may-alaska-november-september
File name:	Requested Offer 3000082745.js
Download:	download sample
Signature	MassLogger Alert Create hunting rule
File size:	120'565 bytes
First seen:	2025-04-17 11:28:35 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	3072:B55t7X2rXkvLmvLfplCqVgYPOCgaKn20J4bMYuSvfIQEePVz:HbX2rXkvL4bpBVhPOCgae4vvfIQl
Threatray	884 similar samples on MalwareBazaar
TLSH	T17DC33A3CE9E9AEC043423CD02B8F2A64E5890757113753AEE8ED211AB86445DD673FBD
Magika	javascript
Reporter	abuse_ch
Tags:	js MassLogger

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

457

Origin country :

NL

Vendor Threat Intelligence

CyberFortress Malicious

Verdict:

Malicious

Score:

94.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6800e9af2203b3e10cd03503

Tags:

obfuscate autorun xtreme shell

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

obfuscated

Link:

https://www.filescan.io/uploads/6800e61190767142c3d8ebc5/reports/2fcb48da-8242-45d5-8128-4113cacc6f8f/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/dc89f1981a7cc11ca6074aec4c09e0a1154d31474a0f51a5e5d57153741a00bd

Joe Sandbox Batch Injector, MSIL Logger, MassLogger

Result

Threat name:

Batch Injector, MSIL Logger, MassLogger

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1667440

Signature

.NET source code contains a sample name check

.NET source code contains potential unpacker

.NET source code references suspicious native API functions

Bypasses PowerShell execution policy

Contains functionality to log keystrokes (.Net Source)

Drops script or batch files to the startup folder

Found malware configuration

Found suspicious powershell code related to unpacking or dynamic code loading

Joe Sandbox ML detected suspicious sample

JScript performs obfuscated calls to suspicious functions

Malicious sample detected (through community Yara rule)

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: Drops script at startup location

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: PowerShell Base64 Encoded Invoke Keyword

Sigma detected: Suspicious PowerShell Parameter Substring

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Yara detected Batch Injector

Yara detected MassLogger RAT

Yara detected MSIL Logger

Yara detected Powershell decode and execute

Yara detected Telegram RAT

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/dc89f1981a7cc11ca6074aec4c09e0a1154d31474a0f51a5e5d57153741a00bd

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/dc89f1981a7cc11ca6074aec4c09e0a1154d31474a0f51a5e5d57153741a00bd/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=3se7dga2ptarzjqhjlweycpaueku2mkhjihvdjpf2vyvg5a2ac6q._file

Threatray novastealer

Verdict:

malicious

Label(s):

novastealer

Alert

Create hunting rule

Similar samples:

7652d55f845a4914f76058c418df4da0c65f7df5f0febb2aded459ae0b75be61

MassLogger

8e7ff7945bf58f74f96544ccd03b1a6256febb60e67a558cd55080f6a23cef86

MassLogger

9654cbd553df628f50a99ec6f8b405901898c3c9eb99c8a3ba4fbd586290948b

MassLogger

a219e517e4f68db96fa6c7bf2d044b991043884cb1ac1dbd5de22ec5f08ddb00

MassLogger

bedb516c0bbfe25e36c26f81d37be534ab096c087fc4e866fb20bf68cf4b9123

MassLogger

cb45d6a207ad4218619ad1b7e1001b55201894ef21f717588e5f3df5122c0583

MassLogger

ddc6b2bd4382d1ae45bee8f3c4bb19bd20933a55bdf5c2e76c8d6c46bc1516ce

MassLogger

error

MassLogger

f344de0d137247e297701368c696119f63122fdf8b08c0893eaff7eea50c6fc9

MassLogger

+ 874 additional samples on MalwareBazaar

Hatching Triage masslogger

Result

Malware family:

masslogger

Alert

Create hunting rule

Score:

  10/10

Tags:

family:masslogger collection discovery execution spyware stealer

Link:

https://tria.ge/reports/250417-nlqy3asyfv/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Checks computer location settings

Drops startup file

Blocklisted process makes network request

Command and Scripting Interpreter: PowerShell

MassLogger

Masslogger family

Malware Config

C2 Extraction:

https://api.telegram.org/bot7739919249:AAHKGHTy78jD_XCuFhjoHrf_l_sOV-bS69k/sendMessage?chat_id=5382791083

VMRay PrivateLogger

Malware family:

PrivateLogger

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/dc89f1981a7c/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.