MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 488bc747c7643f0e411b2793b51edbbabe0451107fcf6ceaaa8f2f78125a476e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	488bc747c7643f0e411b2793b51edbbabe0451107fcf6ceaaa8f2f78125a476e
SHA3-384 hash:	bf2ebc9d412c48fa779875ae1271f7fb7260030fe7e0f2a0182dbedb15140d210e66f277fcd03d9d65105ba60502b3b2
SHA1 hash:	d97cbeb144306bc49610d57e5043d6a779c86588
MD5 hash:	7ec887b0b4ababc2c3dfc0384367d303
humanhash:	speaker-ceiling-sodium-beer
File name:	gjawhixj.JS
Download:	download sample
Signature	AgentTesla Alert Create hunting rule
File size:	4'056'536 bytes
First seen:	2026-07-14 09:43:55 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	98304:vzCNYt1llGbxmgeFmBdBiMqJgjuGoUE5gwSP0GNQ8E4gmUq:vzt1lQbx2iyMqdUmglPxx
TLSH	T193166C405E9CA782B9FCC718882EBBF10D1EC817A554DF47315D8A9E1A8DF06339C69B
Magika	javascript
Reporter	JAMESWT_WT
Tags:	AgentTesla ftp-enogcaen-br-com js

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

133

Origin country :

IT

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.VBS.Obfus-168.UNOFFICIAL

Alert

Create hunting rule

Sanesecurity.Malware.31320.UNOFFICIAL

Alert

Create hunting rule

Sanesecurity.Malware.32567.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

96.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a56044556bd89099b5532fa

Tags:

autorun autoit emotet

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-debug autoit dropper evasive fingerprint keylogger lolbin obfuscated persistence reconnaissance repaired schtasks

Link:

https://www.filescan.io/uploads/6a5605078079de36a7fd9369/reports/b3a94967-40af-4d22-9720-024f0aca9bca/overview

Hybrid Analysis Trojan.Generic

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/488bc747c7643f0e411b2793b51edbbabe0451107fcf6ceaaa8f2f78125a476e

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

First seen:

2026-05-11T03:04:00Z UTC

Last seen:

2026-07-08T03:50:00Z UTC

Hits:

~1000

Link:

https://opentip.kaspersky.com/488bc747c7643f0e411b2793b51edbbabe0451107fcf6ceaaa8f2f78125a476e/results?tab=lookup

Malva.RE

Gathering data

CERT.PL MWDB agenttesla

Detection:

agenttesla

Alert

Create hunting rule

Link:

https://mwdb.cert.pl/sample/488bc747c7643f0e411b2793b51edbbabe0451107fcf6ceaaa8f2f78125a476e/

ReversingLabs TitaniumCloud Script-JS.Spyware.Negasteal

Threat name:

Script-JS.Spyware.Negasteal

Alert

Create hunting rule

Status:

Suspicious

First seen:

2026-05-11 13:10:03 UTC

File Type:

Binary

AV detection:

11 of 36 (30.56%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=jcf4or6hmq7q4qi3e6j3khw3xk7aiuiqp7hwz2vkr4xxqes2i5xa._file

Hatching Triage donutloader

Result

Malware family:

donutloader

Alert

Create hunting rule

Score:

  10/10

Tags:

family:agenttesla family:donutloader collection discovery execution keylogger loader persistence spyware stealer trojan

Link:

https://tria.ge/reports/260714-lqxw3acx2z/

Behaviour

Scheduled Task/Job: Scheduled Task

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

outlook_office_path

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Checks computer location settings

Executes dropped EXE

Detects DonutLoader

Family: AgentTesla

Family: DonutLoader

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/488bc747c7643f0e411b2793b51edbbabe0451107fcf6ceaaa8f2f78125a476e