MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8b8ca853a36d772f8fc6aa0ae71ee1f780d772d19d2ef1a24752ceae14d0fc29. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	8b8ca853a36d772f8fc6aa0ae71ee1f780d772d19d2ef1a24752ceae14d0fc29
SHA3-384 hash:	6324b03985ee8fe3df291fab8062ca82191acc23ef3815e861ba42373d9438cd93a185ce39cc67d9b40d1fcb5f5ffe8e
SHA1 hash:	6b0c7a06a74d96181f0495a9a6d61723ff3c4260
MD5 hash:	a7d5969f45190415af9d25caf4f9b21c
humanhash:	jig-apart-berlin-indigo
File name:	SWIFT COPY.JS
Download:	download sample
Signature	AgentTesla Alert Create hunting rule
File size:	3'374'184 bytes
First seen:	2026-05-08 07:39:39 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	98304:LytnJ6/W5N5q9UehgVOFw7ki0BzM6Pm+sZQM7fEULOP/wT5toSbg8pRr8aWGTj:Lytn15z8ZuVL7ksQgfxpbtRroGTj
TLSH	T1FEF539415A3A5470A66DD72CD03A66540A5D200B15C8FF3D34B862BCF2A2F5B2B6F8F7
Magika	javascript
Reporter	JAMESWT_WT
Tags:	AgentTesla js Spam-ITA

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

128

Origin country :

IT

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

Sanesecurity.Malware.31320.UNOFFICIAL

Alert

Create hunting rule

CyberFortress

Gathering data

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-debug dropper evasive formbook horse obfuscated obfuscated packed repaired

Link:

https://www.filescan.io/uploads/69fd937d7d31ad7bba4f4e80/reports/5c261fa3-848d-4228-9fc6-67fde095105f/overview

Hybrid Analysis Trojan.Generic

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/8b8ca853a36d772f8fc6aa0ae71ee1f780d772d19d2ef1a24752ceae14d0fc29

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

First seen:

2026-05-04T06:48:00Z UTC

Last seen:

2026-05-10T05:42:00Z UTC

Hits:

~10000

Detections:

PDM:Trojan.Win32.Generic HEUR:Trojan-Dropper.Script.Generic HEUR:Trojan.Script.Generic HEUR:Trojan-Downloader.Script.Generic Trojan-Spy.Stealer.FTP.C&C Trojan-PSW.Agensla.TCP.C&C Trojan-Downloader.JS.Cryptoload.sb

Link:

https://opentip.kaspersky.com/8b8ca853a36d772f8fc6aa0ae71ee1f780d772d19d2ef1a24752ceae14d0fc29/results?tab=lookup

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/8b8ca853a36d772f8fc6aa0ae71ee1f780d772d19d2ef1a24752ceae14d0fc29/

Neiki Family.DONUTLOADER

Verdict:

Malicious

Threat:

Family.DONUTLOADER

Link:

https://tip.neiki.dev/file/8b8ca853a36d772f8fc6aa0ae71ee1f780d772d19d2ef1a24752ceae14d0fc29

ReversingLabs TitaniumCloud Win32.Trojan.Malgent

Threat name:

Win32.Trojan.Malgent

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-05-04 13:45:23 UTC

File Type:

Binary

AV detection:

10 of 36 (27.78%)

Threat level:

  5/5

Spamhaus Hash Blocklist Malicious file

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=rogkqu5dnv3s7d6gvifoohxb66ano4wrtuxpdishklhk4fgq7quq._file

Hatching Triage donutloader

Result

Malware family:

donutloader

Alert

Create hunting rule

Score:

  10/10

Tags:

family:agenttesla family:donutloader discovery execution keylogger loader spyware stealer trojan

Link:

https://tria.ge/reports/260508-jhxj8aet3t/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Looks up external IP address via web service

Checks computer location settings

Executes dropped EXE

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Detects DonutLoader

Family: AgentTesla

Family: DonutLoader

VMRay AgentTesla

Malware family:

AgentTesla

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/8b8ca853a36d/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/8b8ca853a36d772f8fc6aa0ae71ee1f780d772d19d2ef1a24752ceae14d0fc29