MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5963a9491c91eae44384e239284fdc74dc3db9ee1b13c24eccc516ece350df34. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	5963a9491c91eae44384e239284fdc74dc3db9ee1b13c24eccc516ece350df34
SHA3-384 hash:	f4f839d89d75e547777e2a56faa14c34da607bccb17720bca634c679b6bdbbfaf998d5db6a5268319e31546bf35cc82f
SHA1 hash:	86ccea739cffd101aaccb08a45f3250e1cfbb099
MD5 hash:	19ae771572b0f04cc31deca91836ed97
humanhash:	happy-stairway-delta-papa
File name:	goodcommuncaitionskilldevleipedfromthegood.js
Download:	download sample
Signature	PureLogsStealer Alert Create hunting rule
File size:	5'976'047 bytes
First seen:	2026-08-19 19:12:44 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	98304:ZAqv8h5g+Hj2xjMTadfxCCdlTrgYEXoh/hihzZqjRgyJJZ9HEXKZDsKsmTZ/raDF:ZZ7+CSTIpzdNr0z8RxTZ9dZI0Zqh
TLSH	T1F1567D8E4155C9DD71EC9F19CC66F6D20B5E81270CA0BF133E2D655D9E48E0A332CAEA
Magika	javascript
Reporter	juroots
Tags:	js PureLogsStealer

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

128

Origin country :

CH

Vendor Threat Intelligence

ACCE Unknown

No detections

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-debug dropper evasive obfuscated obfuscated packed repaired unsafe

Link:

https://www.filescan.io/uploads/6a8600a9878e2cbb730b0c8d/reports/b73f964b-f42e-4551-93d6-4354609d5edb/overview

Hybrid Analysis Trojan.Formbook.JS

Verdict:

Malicious

Labled as:

Trojan.Formbook.JS

Link:

https://www.hybrid-analysis.com/sample/5963a9491c91eae44384e239284fdc74dc3db9ee1b13c24eccc516ece350df34

Nucleon Malprob Malware

Score:

93%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/5963a9491c91eae44384e239284fdc74dc3db9ee1b13c24eccc516ece350df34

Malva.RE

Gathering data

CERT.PL MWDB purelogs

Detection:

purelogs

Alert

Create hunting rule

Link:

https://mwdb.cert.pl/sample/5963a9491c91eae44384e239284fdc74dc3db9ee1b13c24eccc516ece350df34/

ReversingLabs TitaniumCloud Script-JS.Trojan.RemcosRATt

Threat name:

Script-JS.Trojan.RemcosRATt

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-07-28 03:37:58 UTC

File Type:

Text (JavaScript)

AV detection:

14 of 36 (38.89%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=lfr2ssi4shvoiq4e4i4sqt64otod3opodmj4etwmyulozy2q342a._file

Threatray DonutLoader PureCrypter

Verdict:

malicious

Label(s):

DonutLoader

Alert

Create hunting rule

PureCrypter

Alert

Create hunting rule

Link:

https://reports.threatray.com/1019ffea-af41-4aac-9948-ab895b2ba73c

Hatching Triage donutloader

Result

Malware family:

donutloader

Alert

Create hunting rule

Score:

  10/10

Tags:

family:donutloader collection discovery execution loader spyware stealer

Link:

https://tria.ge/reports/260819-xxzj1sgn4w/

Behaviour

Enumerates system info in registry

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Browser Information Discovery

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

System Time Discovery

Accesses Microsoft Outlook profiles

Checks computer location settings

Executes dropped EXE

Reads WinSCP keys stored on the system

Reads user/profile data of web browsers

Detects DonutLoader

Family: DonutLoader

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.