MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5ef2622fd50d4bfa7cd455dc45897770539baa8d8fca1f7cd41a40509375bf6a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	5ef2622fd50d4bfa7cd455dc45897770539baa8d8fca1f7cd41a40509375bf6a
SHA3-384 hash:	56b2bdfc426740942b735c503be0a569ece947bcf3085672235ec7794776befd18adfeb11b2dd7819876099de9085bbc
SHA1 hash:	62378a51e0b2050e5a2d228e3494013a9a3a60e3
MD5 hash:	7d5106ec1d669415f57a6603b533f8f2
humanhash:	mexico-vegan-sixteen-victor
File name:	STAR APHRODITE.JS
Download:	download sample
Signature	AgentTesla Alert Create hunting rule
File size:	4'017'577 bytes
First seen:	2026-05-04 08:57:02 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	98304:G7EMGCZJl9BC3olYJZnAcBJZ5Q39reVk8hvANtYElvRbutsOYMoqnpw0QWQw+pKD:Uv9BC3olYJZnAcBJZ5Q39reVk8hvANts
TLSH	T142064AB65AD7E1237365DFC98639DD70CC0E44432849CF14709EEA3D781DE8AA226B63
Magika	javascript
Reporter	jahlives
Tags:	AgentTesla exe-in-archive js spamtrap

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

146

Origin country :

DE

Vendor Threat Intelligence

ACCE

Gathering data

ClamAV Detected

Detection(s):

SecuriteInfo.com.Generic-EXE.UNOFFICIAL

Alert

Create hunting rule

Sanesecurity.Malware.31320.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-debug base64 dropper evasive formbook obfuscated obfuscated overlay packed remcos repaired

Link:

https://www.filescan.io/uploads/69f85f7d2fcb905ec27d157d/reports/80e65c26-7225-4bfd-abef-15c67e83b720/overview

Hybrid Analysis JS/Obfus.A.gen

Verdict:

Malicious

Labled as:

JS/Obfus.A.gen

Link:

https://www.hybrid-analysis.com/sample/5ef2622fd50d4bfa7cd455dc45897770539baa8d8fca1f7cd41a40509375bf6a

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

First seen:

2026-05-04T01:44:00Z UTC

Last seen:

2026-05-06T07:27:00Z UTC

Hits:

~1000

Detections:

Trojan-Downloader.JS.Cryptoload.sb HEUR:Trojan.Script.Generic HEUR:Trojan-Dropper.Script.Generic HEUR:Trojan-Downloader.Script.Generic

Link:

https://opentip.kaspersky.com/5ef2622fd50d4bfa7cd455dc45897770539baa8d8fca1f7cd41a40509375bf6a/results?tab=lookup

Malva.RE inconclusive

Verdict:

inconclusive

YARA:

1 match(es)

Tags:

Base64 Block Base64 Payload Contains Base64 Block Executable PE (Portable Executable) PE File Layout

Link:

https://app.malva.re/file/7d5106ec1d669415f57a6603b533f8f2

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/5ef2622fd50d4bfa7cd455dc45897770539baa8d8fca1f7cd41a40509375bf6a/

ReversingLabs TitaniumCloud Script-JS.Trojan.Qwexlafiba

Threat name:

Script-JS.Trojan.Qwexlafiba

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-05-04 07:02:12 UTC

File Type:

Binary

AV detection:

9 of 24 (37.50%)

Threat level:

  5/5

Spamhaus Hash Blocklist

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=l3zgel6vbvf7u7gukxoelclxobjzxkunr7fb67gudjafbe3vx5va._file

Hatching Triage donutloader

Result

Malware family:

donutloader

Alert

Create hunting rule

Score:

  10/10

Tags:

family:agenttesla family:donutloader execution keylogger loader spyware stealer trojan

Link:

https://tria.ge/reports/260504-kwv4zse19w/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

Looks up external IP address via web service

Checks computer location settings

Executes dropped EXE

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Detects DonutLoader

Family: AgentTesla

Family: DonutLoader

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.