MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 69764623ad18cac42c17d13d243c31f73ea24727b72374c4e7d5f93b6e46bccc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	69764623ad18cac42c17d13d243c31f73ea24727b72374c4e7d5f93b6e46bccc
SHA3-384 hash:	29021fb5567351293f970097edfa7ab4ebc3ec829ef50fe0c7cfefbf3b848adffaa6e5cc72e97ca12b594851d949e303
SHA1 hash:	c471a56195adaba864af4e574fa4c664ef5d26d5
MD5 hash:	80096ba42466ca91e102f1c15d6015be
humanhash:	september-arkansas-table-oscar
File name:	New order N 2160848.js
Download:	download sample
Signature	DonutLoader Alert Create hunting rule
File size:	6'727'950 bytes
First seen:	2026-03-18 12:44:43 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	98304:al3KA97+dLV27WVdJAmAlTfs9hGX13qqqAjnUMLNCMgeKIQ/GKVBc36GpBslZfft:acA9Klk8dKBlTXzpxB1KIQrVC36JRZ1
TLSH	T13666B604E31C5A70FAAD562CD57E7E60890863476244EF3D36BC471DB3A272B139C9EA
Magika	javascript
Reporter	James_inthe_box
Tags:	donutloader exe js

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

136

Origin country :

US

Vendor Threat Intelligence

ACCE Unknown

No detections

CyberFortress Malicious

Verdict:

Malicious

Score:

70%

Link:

https://cyber-fortress.com/docs/result/index.php?id=69ba9e6993b644ca466b4c3f

Tags:

autoit emotet

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-debug autoit dropper evasive expired-cert fingerprint keylogger masquerade obfuscated repaired

Link:

https://www.filescan.io/uploads/69ba9e662000fc76c3e9637a/reports/520b9840-89da-4386-8d50-dbaef222f7e3/overview

Hybrid Analysis JS/Agent.DUI

Verdict:

Suspicious

Labled as:

JS/Agent.DUI

Link:

https://www.hybrid-analysis.com/sample/69764623ad18cac42c17d13d243c31f73ea24727b72374c4e7d5f93b6e46bccc

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

Detections:

HEUR:Trojan-Dropper.Script.Generic HEUR:Trojan.Script.Generic HEUR:Trojan.Script.SAgent.gen

Link:

https://opentip.kaspersky.com/69764623ad18cac42c17d13d243c31f73ea24727b72374c4e7d5f93b6e46bccc/results?tab=lookup

Nucleon Malprob Malware

Score:

96%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/69764623ad18cac42c17d13d243c31f73ea24727b72374c4e7d5f93b6e46bccc

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/69764623ad18cac42c17d13d243c31f73ea24727b72374c4e7d5f93b6e46bccc/

Neiki Family.PUREHVNC

Verdict:

Malicious

Threat:

Family.PUREHVNC

Link:

https://tip.neiki.dev/file/69764623ad18cac42c17d13d243c31f73ea24727b72374c4e7d5f93b6e46bccc

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=nf3emi5nddfmilax2e6sipbr647kerzhw4rxjrhh2x4tw3sgxtga._file

Hatching Triage donutloader

Result

Malware family:

donutloader

Alert

Create hunting rule

Score:

  10/10

Tags:

family:donutloader discovery execution loader

Link:

https://tria.ge/reports/260318-py9sdafz3q/

Behaviour

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Checks computer location settings

Executes dropped EXE

Detects DonutLoader

DonutLoader

Donutloader family

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.60

Link:

https://yomi.yoroi.company/submissions/69764623ad18cac42c17d13d243c31f73ea24727b72374c4e7d5f93b6e46bccc