MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 302fec6dfdf9e2d694e2a6c2f4a7053284b9dc729b1bc0a233f094edcd576976. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DonutLoader


Vendor detections: 13


Intelligence 13 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 302fec6dfdf9e2d694e2a6c2f4a7053284b9dc729b1bc0a233f094edcd576976
SHA3-384 hash: a1c831ea5a1b7e1218df4c0d86184b0ff305fc892f0ff496e1fdc68a3feee920370911fddf5b8f5c8f82f4ebdb019dd6
SHA1 hash: d310c046f97771d0d4a990be4aa3388eada0c0b8
MD5 hash: 4c2d6eb4c6c66b4133f11287394abda1
humanhash: pennsylvania-lamp-kilo-enemy
File name:New_Order_PO031430.js
Download: download sample
Signature DonutLoader
Create hunting rule
File size:1'278'303 bytes
First seen:2026-07-08 13:21:23 UTC
Last seen:Never
File type:Java Script (JS) js
MIME type:text/plain
ssdeep 24576:xXJ29SjY5zzPuqsFn2hhdtNl9NNgb5sljizBXDq:+I0hdT8eQM
Threatray 2'145 similar samples on MalwareBazaar
TLSH T1DB453346FF797DBF455CC30931AB2FAF4C700DC68A9DACDB9690AAA7424E5D84217038
Magika javascript
Reporter threatcat_ch
Tags:donutloader js

Intelligence

File Origin
# of uploads :
1
# of downloads :
165
Origin country :
CH CH
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Score:
92.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a4e4ee613f68731ed6a99bf
Tags:
xtreme shell sage
Verdict:
Malicious
Labled as:
SVM:TrojanDownloader/JS.Nemucod
Link:
https://www.hybrid-analysis.com/sample/302fec6dfdf9e2d694e2a6c2f4a7053284b9dc729b1bc0a233f094edcd576976
Verdict:
Malicious
File Type:
js
First seen:
2026-07-08T04:02:00Z UTC
Last seen:
2026-07-10T11:20:00Z UTC
Hits:
~10000
Detections:
HEUR:Worm.Script.Generic HEUR:Trojan.PowerShell.Kryptik.gen HEUR:Trojan-Downloader.Script.Generic Trojan.Win32.Shellcode.sb Trojan.JS.SAgent.sb Trojan-Dropper.JS.SDrop.sb HEUR:Trojan.Script.Generic Trojan.Win32.PoverTel.sb
Link:
https://opentip.kaspersky.com/302fec6dfdf9e2d694e2a6c2f4a7053284b9dc729b1bc0a233f094edcd576976/results?tab=lookup
Result
Threat name:
Koadic, DonutLoader, FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1939289
Signature
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Binary is likely a compiled AutoIt script file
Creates a thread in another existing process (thread injection)
Found direct / indirect Syscall (likely to bypass EDR)
Found suspicious powershell code related to unpacking or dynamic code loading
JavaScript file contains suspicious strings
JavaScript source code contains functionality to generate code involving a shell, file or stream
Joe Sandbox ML detected suspicious sample
JScript performs obfuscated calls to suspicious functions
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sigma detected: Powerup Write Hijack DLL
Sigma detected: Suspicious PowerShell Parameter Substring
Sigma detected: Suspicious Script Execution From Temp Folder
Sigma detected: WScript or CScript Dropper
Suricata IDS alerts for network traffic
Suspicious execution chain found
Suspicious powershell command line found
Switches to a custom stack to bypass stack traces
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Unusual module load detection (module proxying)
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
WScript reads language and country specific registry keys (likely country aware script)
Wscript starts Powershell (via cmd or directly)
Yara detected DonutLoader
Yara detected FormBook
Yara detected Koadic BAT payload
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1939289 Sample: New_Order_PO031430.js Startdate: 08/07/2026 Architecture: WINDOWS Score: 100 68 www.vadelix.com 2->68 70 www.plantaonewsms.com.br 2->70 72 10 other IPs or domains 2->72 94 Suricata IDS alerts for network traffic 2->94 96 Malicious sample detected (through community Yara rule) 2->96 98 Antivirus detection for URL or domain 2->98 100 12 other signatures 2->100 13 wscript.exe 1 2 2->13         started        17 svchost.exe 1 1 2->17         started        20 tunnel.sys 4 2->20         started        signatures3 process4 dnsIp5 64 C:\Users\user\AppData\...\tmp323905.bat.gz, gzip 13->64 dropped 122 JScript performs obfuscated calls to suspicious functions 13->122 124 Suspicious powershell command line found 13->124 126 Wscript starts Powershell (via cmd or directly) 13->126 128 3 other signatures 13->128 22 cmd.exe 2 13->22         started        26 powershell.exe 16 13->26         started        66 127.0.0.1 unknown unknown 17->66 file6 signatures7 process8 file9 60 C:\Users\user\AppData\...\aqxuklgowzoifs.ps1, ASCII 22->60 dropped 104 Wscript starts Powershell (via cmd or directly) 22->104 28 powershell.exe 23 22->28         started        30 conhost.exe 22->30         started        62 C:\Users\user\AppData\Local\...\tmp323905.bat, ASCII 26->62 dropped 106 Found suspicious powershell code related to unpacking or dynamic code loading 26->106 32 conhost.exe 26->32         started        signatures10 process11 process12 34 vijewyufveonabghulluonouceyasi.exe 28->34         started        37 conhost.exe 28->37         started        signatures13 88 Writes to foreign memory regions 34->88 90 Allocates memory in foreign processes 34->90 92 Creates a thread in another existing process (thread injection) 34->92 39 msra.exe 1 34->39         started        process14 signatures15 108 Modifies the context of a thread in another process (thread injection) 39->108 110 Maps a DLL or memory area into another process 39->110 112 Queues an APC in another process (thread injection) 39->112 114 2 other signatures 39->114 42 xEefrDWFb.exe 39->42 injected 45 msra.exe 1 9 39->45         started        47 msra.exe 39->47         started        process16 signatures17 116 Binary is likely a compiled AutoIt script file 42->116 118 Maps a DLL or memory area into another process 42->118 120 Found direct / indirect Syscall (likely to bypass EDR) 42->120 49 SearchIndexer.exe 13 42->49         started        process18 signatures19 80 Tries to steal Mail credentials (via file / registry access) 49->80 82 Tries to harvest and steal browser information (history, passwords, etc) 49->82 84 Modifies the context of a thread in another process (thread injection) 49->84 86 3 other signatures 49->86 52 UUjKonh7.exe 49->52 injected 56 firefox.exe 49->56         started        58 chrome.exe 49->58         started        process20 dnsIp21 74 hk6.msthx.com 103.175.129.124, 49732, 49734, 49735 UK2NET-ASGB United Kingdom 52->74 76 parking.d.parity.domains 72.251.11.125, 49705, 49706, 49707 OVHFR Canada 52->76 78 3 other IPs or domains 52->78 102 Binary is likely a compiled AutoIt script file 52->102 signatures22
Score:
99%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/302fec6dfdf9e2d694e2a6c2f4a7053284b9dc729b1bc0a233f094edcd576976
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/302fec6dfdf9e2d694e2a6c2f4a7053284b9dc729b1bc0a233f094edcd576976/
Verdict:
Malicious
Threat:
Family.DONUTLOADER
Link:
https://tip.neiki.dev/file/302fec6dfdf9e2d694e2a6c2f4a7053284b9dc729b1bc0a233f094edcd576976
Threat name:
Script-JS.Trojan.DonutLoader
Create hunting rule
Status:
Malicious
First seen:
2026-07-08 12:58:06 UTC
File Type:
Text (HTML)
AV detection:
14 of 38 (36.84%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=gax6y3p57hrnnfhcu3bpjjyfgkcltxdstmn4birt6cko3tkxnf3a._file
Verdict:
malicious
Label(s):
donutloader
Create hunting rule
Similar samples:
2b63ff1a501c9691349592ee32a0c265fbdf162129d727549db43a510a6cdeb7
DonutLoader
54cfc24834d34abefe3691137579845d278a455f331c36de0315a6f89b8d4906
DonutLoader
8bce779c21544d2c9006d1624b7929b467111260bd65c9562830aed303a0343b
DonutLoader
920039788b3a1620bbafc5b02d10827ce68ec4bb6f9088014f76c8eecb01875d
DonutLoader
bebbd92d12dbc0071acce399db475182067b1dd3000632915851888509a10ad8
DonutLoader
c09255d1b0b54132c0d40502ad635bcff41a9a3f92427b39879d620e96eb387d
DonutLoader
cd368170dc9f51be621d232020b5e2be0b1a157fea254d8ea10717ac1b606e10
DonutLoader
e0210e510cdeec97354308971ac2b3f047b4df8d464896c1a2a982a35a99c070
DonutLoader
e98eb44d6362361b1b920e733ab681107894acbc3f2e8f6373c1c1e0ee95b8d7
DonutLoader
eb5558d414c6f96efeb30db704734c463eb08758a3feacf452d743ba5f8fe662
DonutLoader
error
DonutLoader
+ 2'135 additional samples on MalwareBazaar
Result
Malware family:
donutloader
Create hunting rule
Score:
  10/10
Tags:
family:donutloader adware discovery execution loader persistence ransomware spyware
Link:
https://tria.ge/reports/260708-qme93afz5w/
Behaviour
Checks SCSI registry key(s)
Modifies Internet Explorer settings
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Uses Volume Shadow Copy WMI provider
Uses Volume Shadow Copy service COM API
Command and Scripting Interpreter: JavaScript
Command and Scripting Interpreter: PowerShell
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Enumerates connected drives
Checks computer location settings
Executes dropped EXE
Boot or Logon Autostart Execution: Active Setup
Detects DonutLoader
Family: DonutLoader
Malware family:
DonutLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/302fec6dfdf9/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/302fec6dfdf9e2d694e2a6c2f4a7053284b9dc729b1bc0a233f094edcd576976

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BlackGuard_Rule
Create hunting rule
Author:Jiho Kim
Description:Yara rule for BlackGuarad Stealer v1.0 - v3.0
Reference:https://www.virustotal.com/gui/file/67843d45ba538eca29c63c3259d697f7e2ba84a3da941295b9207cdb01c85b71/detection
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

DonutLoader

Java Script (JS) js 302fec6dfdf9e2d694e2a6c2f4a7053284b9dc729b1bc0a233f094edcd576976

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments