MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fdd96aba675606113ee424eb6c31f8dc47d9afbb0e83e8bebcb6299f2fa35cce. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	fdd96aba675606113ee424eb6c31f8dc47d9afbb0e83e8bebcb6299f2fa35cce
SHA3-384 hash:	08207b9a13cc7d3e1844680f4104e16ce61b203f028c4db3bed035366e59878fba21ffc5ee0349699d21f7f642f57e93
SHA1 hash:	1d1a3ab4b6932d9f52f8f7e4566c183a1557a5b2
MD5 hash:	8ca4aece905648797ac6ee4758bcd75e
humanhash:	spring-juliet-fruit-ohio
File name:	BL2038784680.JS
Download:	download sample
Signature	MassLogger Alert Create hunting rule
File size:	3'182'477 bytes
First seen:	2026-07-23 12:32:45 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	98304:t+3wgGKE7cFLz3Om3HCNENK0uUqS9OS21VQKONffzteJ72SYWOV+:0nGKE7cFHJKH8OSsaKOFfwJ6pV+
TLSH	T160E5B310576460737365D36CD236AEB8C00E200736D9CB88305E9A64B51EE97A7FABF7
Magika	javascript
Reporter	James_inthe_box
Tags:	exe js MassLogger

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

178

Origin country :

US

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

Sanesecurity.Malware.31320.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-debug downloader dropper evasive obfuscated packed repaired xloader

Link:

https://www.filescan.io/uploads/6a620a1fbe5fa5bfa931296b/reports/60221d6f-1517-41c6-995a-9c4a70a971c9/overview

Hybrid Analysis Trojan.Generic

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/fdd96aba675606113ee424eb6c31f8dc47d9afbb0e83e8bebcb6299f2fa35cce

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

First seen:

2026-07-20T14:54:00Z UTC

Last seen:

2026-07-24T08:06:00Z UTC

Hits:

~1000

Link:

https://opentip.kaspersky.com/fdd96aba675606113ee424eb6c31f8dc47d9afbb0e83e8bebcb6299f2fa35cce/results?tab=lookup

Nucleon Malprob Malware

Score:

96%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/fdd96aba675606113ee424eb6c31f8dc47d9afbb0e83e8bebcb6299f2fa35cce

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/fdd96aba675606113ee424eb6c31f8dc47d9afbb0e83e8bebcb6299f2fa35cce/

ReversingLabs TitaniumCloud Win32.Trojan.Ravartar

Threat name:

Win32.Trojan.Ravartar

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-07-21 02:44:49 UTC

File Type:

Text (JavaScript)

AV detection:

14 of 36 (38.89%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=7xmwvothkydbcpxeetvwympy3rd5tl53b2b6rpv4wyuz6l5dltha._file

Threatray NovaStealer

Verdict:

malicious

Label(s):

NovaStealer

Alert

Create hunting rule

Link:

https://reports.threatray.com/e90a64e4-10ef-40aa-b7b3-0c71ed366bb2

Similar samples:

0041750b145156664772aef035961d7723957fe70a15a1563129224106d09769

MassLogger

6c0474d7cf20a8a8ced7f9a5a59609ee58245a9a413e73d1738dad13f85d7f2b

MassLogger

8da9fd778e01e2089de2c8874a80489b0c42afbc3f7499f4a5e6b6cd5c1ca658

MassLogger

b1407ede7cf6976b4d234573be97175987019fceacfd76141f4083cc731fc7f2

MassLogger

b5c078c186f17edf92e101e8df4d49f0e89515f81ce4dbbcbb611e76417ca978

MassLogger

d010314800912704efec2cca545328ef2eb9a97893c34271d92df69e207f4a7c

MassLogger

e68e2cde02efea3eeaff3125e510ce5fba502d918e379ba0a1ed8f808079dc0d

MassLogger

ebbee1d2030789e37bd47f5e1f5cac792af7c31c05a451d220e03672202c07ea

MassLogger

efc5f23ff325be267fa80f88dbbf0abefc4f479b52a6c8b0dd4963c39f3bf177

MassLogger

Hatching Triage masslogger

Result

Malware family:

masslogger

Alert

Create hunting rule

Score:

  10/10

Tags:

family:masslogger collection discovery execution spyware stealer

Link:

https://tria.ge/reports/260723-prgs1scn5z/

Behaviour

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

Executes a command shell one-liner

System Location Discovery: System Language Discovery

Suspicious use of NtSetInformationThreadHideFromDebugger

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Checks computer location settings

Executes dropped EXE

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Family: MassLogger

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/fdd96aba675606113ee424eb6c31f8dc47d9afbb0e83e8bebcb6299f2fa35cce