Concatenating outputs of a loop into a string in JS

What I need to do is make a function that takes a string and replaces the string with say a "#" except for the last 4 characters of that string. After some research I know there is simpler ways of doing it then what I'm doing now, but since I came up with this myself I would like to finish it.

  function hash(cc){
    let i = 0;
    let mask = "";
      for(; i < cc.length; i++){
        if(i < (cc.length - 4)){
          mask.concat("#");
        } else {
          mask.concat(cc[i]);
        }
      }
      console.log(mask);
    }

  hash("123456789batman!")