🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e6553b7599e6f8d8d75eb699df2df2020cdf3f3b6f852b8875289d6c41265871. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 11


Intelligence 11 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e6553b7599e6f8d8d75eb699df2df2020cdf3f3b6f852b8875289d6c41265871
SHA3-384 hash: 2c4b504755a786f1f93bc12bc74df2ae09aec824ef42e2837d7a14aa3851ccc7e231654325b8ec26bac22cd7923d027e
SHA1 hash: ed583c6096b7dbd79a179728afea999249affd0d
MD5 hash: 7789d8b10942ef4317375019408bab1a
humanhash: ohio-one-north-twelve
File name:Shock.ps1
Download: download sample
Signature MassLogger
Create hunting rule
File size:174'018 bytes
First seen:2026-04-29 11:47:36 UTC
Last seen:Never
File type:PowerShell (PS) ps1
MIME type:text/plain
ssdeep 3072:u1qpfVd2UwF9O/sgl0y37m91aEvpmBLCVrTxhs+GcozgcU4UyjdZCWOWqS3es:HVWO/sgh37m90A7/7ozvU4lvC2l
Threatray 2'062 similar samples on MalwareBazaar
TLSH T165042361FF6EAF7B33A4C21D718FC548ED258A3481B49194D60AD486ADEE51FC32BC18
Magika powershell
Reporter BastianHein
Tags:MassLogger ps1

Intelligence

File Origin
# of uploads :
1
# of downloads :
147
Origin country :
CL CL
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
aes base64 crypto encrypted evasive obfuscated powershell
Link:
https://www.filescan.io/uploads/69f1f01081aa9ec3bc320f34/reports/d106cf12-bfa2-4c48-b6fb-73cd190ca7c5/overview
Verdict:
Malicious
Labled as:
CMD:BZC.PZQ.Boxter.441
Link:
https://www.hybrid-analysis.com/sample/e6553b7599e6f8d8d75eb699df2df2020cdf3f3b6f852b8875289d6c41265871
Verdict:
Malicious
File Type:
ps1
First seen:
2026-04-29T09:03:00Z UTC
Last seen:
2026-04-29T09:34:00Z UTC
Hits:
~10
Detections:
Trojan.Win32.HTA.a PDM:Trojan.Win32.Generic
Link:
https://opentip.kaspersky.com/e6553b7599e6f8d8d75eb699df2df2020cdf3f3b6f852b8875289d6c41265871/results?tab=lookup
Score:
66%
Verdict:
Susipicious
File Type:
SCRIPT
Link:
https://malprob.io/report/e6553b7599e6f8d8d75eb699df2df2020cdf3f3b6f852b8875289d6c41265871
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e6553b7599e6f8d8d75eb699df2df2020cdf3f3b6f852b8875289d6c41265871/
Verdict:
Malicious
Threat:
Family.DONUTLOADER
Link:
https://tip.neiki.dev/file/e6553b7599e6f8d8d75eb699df2df2020cdf3f3b6f852b8875289d6c41265871
Threat name:
Win32.Dropper.Boxter
Create hunting rule
Status:
Malicious
First seen:
2026-04-29 11:48:50 UTC
File Type:
Text (PowerShell)
AV detection:
6 of 24 (25.00%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4zktw5mz434nrv26w2m56lpsaign6pz3n6csxcdvfcowyqjglbyq._file
Verdict:
malicious
Label(s):
novastealer
Create hunting rule
donutloader
Create hunting rule
Similar samples:
0ee4884dfdabb081b394ce074fbe0dd408056ca7616694bdba188ac6db50a1e2
MassLogger
17c2f81cc2e3b987c9790caf88bfff34fec7cf00b4dadbe6ee913e482dec925a
MassLogger
2b9067eeb7909d5e78c83d9a37b379d6531a5b893d5a002b06c4f851edb1f402
MassLogger
340d44d2823cbb4630451f02fbf087f246c91d93ba89716af630fa7c0c6d35ed
MassLogger
5eb94225a7d4d5aff1fbea4c97e210ddbebf6f09365f658a5571f7d6b8e0da5c
MassLogger
79582e012802adcffa4d96ba0ae9a7138f771aeeb76f858ed5af09ff94e45f94
MassLogger
7ac07536c76c62c163ceabf2e2e877fe3877b3414d95d36d50d8d5838a548fed
MassLogger
95b620de060eaaedf521423892275b8fe6f635e720c9f294704d1f1df5b46036
MassLogger
ae7ba52112fa966df1b3c42592f870f9106edcb3f0f3cf36f1377b6a8e41bb19
MassLogger
d4ddc00abfc90f17f67aa75bf122351f5c2ef7c2b9d475ac185053485c50f54d
MassLogger
error
MassLogger
+ 2'052 additional samples on MalwareBazaar
Result
Malware family:
masslogger
Create hunting rule
Score:
  10/10
Tags:
family:donutloader family:masslogger collection execution loader spyware stealer
Link:
https://tria.ge/reports/260429-nypxjaft3p/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Command and Scripting Interpreter: PowerShell
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Detects DonutLoader
Family: DonutLoader
Family: MassLogger
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.70
Link:
https://yomi.yoroi.company/submissions/e6553b7599e6f8d8d75eb699df2df2020cdf3f3b6f852b8875289d6c41265871

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:detect_powershell
Create hunting rule
Author:daniyyell
Description:Detects suspicious PowerShell activity related to malware execution
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments