MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 854f438df394fb8bb4052b8f43bf7008d39ae83f0e55f44e126029061dafbab6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	854f438df394fb8bb4052b8f43bf7008d39ae83f0e55f44e126029061dafbab6
SHA3-384 hash:	b53dd44d51ff5a26967351878914cf8adba72fc3fe9b7f6b227a4fd5f9d726d2e1600ff07bbaf85582c09bf8b8ca9ee4
SHA1 hash:	c8431443017eaf39d07789d9d388f5ba097c17d3
MD5 hash:	b6d5495446137f5ef0761961ab9f1c9b
humanhash:	beer-monkey-magazine-twenty
File name:	[REQ] - NEW INQUIRY 2026.JS
Download:	download sample
Signature	XWorm Alert Create hunting rule
File size:	3'026'096 bytes
First seen:	2026-06-23 08:03:05 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	49152:HLweIeohVGpDK040GpO0T439sB9l1p4SiyUrPWjKTZEj47sYn9Kefk5TkYqPEIrz:HLwAohVGpDSO0T439sB9lsSDUrPWjKTj
TLSH	T1D0E50751CA25A634797CCB2ED037AFB0045E20479538EF2E353A9A18A946F8F139D4F7
Magika	javascript
Reporter	abuse_ch
Tags:	js xworm

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

174

Origin country :

SE

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

Sanesecurity.Malware.31320.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

90.2%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a3a3ea186bc95245bf8d73a

Tags:

muldrop virus blic

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-debug dropper evasive obfuscated obfuscated packed repaired

Link:

https://www.filescan.io/uploads/6a3a3e4e9799578a6c474e3e/reports/5384aefd-54d4-4487-9d17-7404aeb14cc5/overview

Hybrid Analysis JS/TrojanDropper.Agent

Verdict:

Malicious

Labled as:

JS/TrojanDropper.Agent

Link:

https://www.hybrid-analysis.com/sample/854f438df394fb8bb4052b8f43bf7008d39ae83f0e55f44e126029061dafbab6

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

First seen:

2026-06-22T18:49:00Z UTC

Last seen:

2026-06-25T05:35:00Z UTC

Hits:

~1000

Detections:

Trojan-Dropper.JS.SDrop.sb HEUR:Trojan-Dropper.Script.Generic HEUR:Trojan.Script.Lubfus.gen HEUR:Trojan.Script.Generic HEUR:Trojan-Downloader.Script.Generic

Link:

https://opentip.kaspersky.com/854f438df394fb8bb4052b8f43bf7008d39ae83f0e55f44e126029061dafbab6/results?tab=lookup

Joe Sandbox DonutLoader, XWorm

Result

Threat name:

DonutLoader, XWorm

Alert

Create hunting rule

Detection:

malicious

Classification:

evad.troj

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1932412

Signature

Benign windows process drops PE files

C2 URLs / IPs found in malware configuration

Drops PE files to the document folder of the user

Drops PE files with a suspicious file extension

Found API chain indicative of debugger detection

Found direct / indirect Syscall (likely to bypass EDR)

Found malware configuration

Joe Sandbox ML detected suspicious sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sample uses string decryption to hide its real strings

Sigma detected: WScript or CScript Dropper

Suspicious WerFault Winsock library load

Unusual module load detection (module proxying)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

WScript reads language and country specific registry keys (likely country aware script)

Yara detected DonutLoader

Yara detected Lua decrypt and execute

Yara detected XWorm

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

94%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/854f438df394fb8bb4052b8f43bf7008d39ae83f0e55f44e126029061dafbab6

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/854f438df394fb8bb4052b8f43bf7008d39ae83f0e55f44e126029061dafbab6/

Neiki Family.DONUTLOADER

Verdict:

Malicious

Threat:

Family.DONUTLOADER

Link:

https://tip.neiki.dev/file/854f438df394fb8bb4052b8f43bf7008d39ae83f0e55f44e126029061dafbab6

ReversingLabs TitaniumCloud Script-JS.Packed.Generic

Threat name:

Script-JS.Packed.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2026-06-23 02:24:22 UTC

File Type:

Text (JavaScript)

AV detection:

12 of 24 (50.00%)

Threat level:

  1/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=qvhuhdptst5yxnaffohuhp3qbdjzv2b7bzk7itqsmauqmhnpxk3a._file

Threatray xworm donutloader

Verdict:

malicious

Label(s):

xworm

Alert

Create hunting rule

donutloader

Alert

Create hunting rule

Similar samples:

error

XWorm

Hatching Triage xworm

Result

Malware family:

xworm

Alert

Create hunting rule

Score:

  10/10

Tags:

family:donutloader family:xworm execution loader rat trojan

Link:

https://tria.ge/reports/260623-jyqfvabs3j/

Behaviour

Modifies registry class

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

Checks computer location settings

Executes dropped EXE

Detect Xworm Payload

Detects DonutLoader

Family: DonutLoader

Family: Xworm

Malware Config

C2 Extraction:

104.239.66.178:7004

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.55

Link:

https://yomi.yoroi.company/submissions/854f438df394fb8bb4052b8f43bf7008d39ae83f0e55f44e126029061dafbab6