MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f620ef8549eafd140bc89428027e3f379efac6e5af6ef52c0cda44600464c66d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	f620ef8549eafd140bc89428027e3f379efac6e5af6ef52c0cda44600464c66d
SHA3-384 hash:	8050edabfaff1420c4dbbf8c24e0b9441712e5ff42535c8cdbe35d23e3f683b88eb22756de3719bb0a718dd84536662e
SHA1 hash:	84aa6c1120403e77529548018321e446cd1548b0
MD5 hash:	c5799ed83b29f384e3f684dcb8c9f922
humanhash:	winner-asparagus-hotel-echo
File name:	Quotes0001.js
Download:	download sample
Signature	MassLogger Alert Create hunting rule
File size:	358'229 bytes
First seen:	2025-05-21 07:56:04 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	96:V5s/BpZKBpnpsuBpZFBpMpsLBp9BpBprpsNBpZrBpkfspBp9uBprBpsHBpZKjBpp:hCsvAlyIaq+E8
Threatray	1'196 similar samples on MalwareBazaar
TLSH	T143742B9DADE70456259FF730A68725BC982B6354C902A6FBE377F63310B8E5C20F1066
Magika	javascript
Reporter	abuse_ch
Tags:	js MassLogger

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

437

Origin country :

NL

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.Script.SNH-gen.19248.1238.UNOFFICIAL

Alert

Create hunting rule

Sanesecurity.Malware.31898.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

97.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=682d8728c28c67d666437d37

Tags:

obfuscate xtreme shell

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

obfuscated

Link:

https://www.filescan.io/uploads/682d872bc609634bd7cd40be/reports/e5a98d5f-522a-4f81-aaad-fb0fb7706e9e/overview

Hybrid Analysis JS/TrojanDownloader.Agent

Verdict:

Malicious

Labled as:

JS/TrojanDownloader.Agent

Link:

https://www.hybrid-analysis.com/sample/f620ef8549eafd140bc89428027e3f379efac6e5af6ef52c0cda44600464c66d

Joe Sandbox MSIL Logger, MassLogger RAT

Result

Threat name:

MSIL Logger, MassLogger RAT

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1695700

Signature

.NET source code references suspicious native API functions

Connects to a pastebin service (likely for C&C)

Contains functionality to capture screen (.Net source)

Contains functionality to log keystrokes (.Net Source)

Creates autostart registry keys with suspicious values (likely registry only malware)

Found malware configuration

Found Tor onion address

Injects a PE file into a foreign processes

Joe Sandbox ML detected suspicious sample

JScript performs obfuscated calls to suspicious functions

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: New RUN Key Pointing to Suspicious Folder

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: Script Initiated Connection to Non-Local Network

Sigma detected: WScript or CScript Dropper

Suricata IDS alerts for network traffic

Suspicious execution chain found

Suspicious powershell command line found

System process connects to network (likely due to code injection or exploit)

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

Wscript starts Powershell (via cmd or directly)

Yara detected MassLogger RAT

Yara detected MSIL Logger

Yara detected Powershell decode and execute

Yara detected Powershell download and execute

Yara detected Telegram RAT

Yara detected UAC Bypass using CMSTP

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Susipicious

Score:

65%

Verdict:

Susipicious

File Type:

SCRIPT

Link:

https://malprob.io/report/f620ef8549eafd140bc89428027e3f379efac6e5af6ef52c0cda44600464c66d

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f620ef8549eafd140bc89428027e3f379efac6e5af6ef52c0cda44600464c66d/

ReversingLabs TitaniumCloud Script-JS.Backdoor.Remcos

Threat name:

Script-JS.Backdoor.Remcos

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-05-20 13:46:52 UTC

File Type:

Text (JavaScript)

AV detection:

7 of 24 (29.17%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=6yqo7bkj5l6ric6isquae7r7g6ppvrxfv5xpklam3jcgabdeyzwq._file

Threatray novastealer

Verdict:

malicious

Label(s):

novastealer

Alert

Create hunting rule

Similar samples:

22974a6d7748c8401d76df5d299e5db3f0ee4a8dfefc4444e85a7726dfc094b1

MassLogger

36f0f94a57df272434cffc01c7a8ceb67d4fab892bba5154a1fceaa38026e007

MassLogger

39783e1d7bb81622b6951ca0019fb51d97ff7f00c12b435de55a82bea6e595a2

MassLogger

55664cf94d480b95c4c7b287dcb36ef045e77e59c3fd77867c872aa51d8ddbf5

MassLogger

7781549276d047ac3720ccdf20caf564e932a69b3910da10f400949c0a51a36f

MassLogger

896bd8cddccec4d5baee8c7abc589630a2ecb6520db30a8b9f6767b76d90fb3c

MassLogger

abd1741192aa6e0d4291a33562e399c1dc503f9f9aec919d8e38ad07732a0954

MassLogger

c608c50993635a38c549100e604aaa86e7b4ac607afffb1f583e6ae5360bf6a9

MassLogger

error

MassLogger

+ 1'186 additional samples on MalwareBazaar

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

execution

Link:

https://tria.ge/reports/250521-jyl4esgj9s/

Behaviour

Script User-Agent

Command and Scripting Interpreter: JavaScript

Blocklisted process makes network request

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/f620ef8549eafd140bc89428027e3f379efac6e5af6ef52c0cda44600464c66d