MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 187d81b53d120b45f31c17f0db98ebf37ac70f3cfc5e4522dd33bc32cf19ad78. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	187d81b53d120b45f31c17f0db98ebf37ac70f3cfc5e4522dd33bc32cf19ad78
SHA3-384 hash:	184f52cde8d1b920b5cc873adc709f624134363ef76bddbecd36f74e5ec885671a2c69de3db4fd1f8a3fc5f1589d2bc1
SHA1 hash:	4fe30dd88d884d8049de3cbb914fcf2a050cc3b7
MD5 hash:	c8bd411a07dbb993a7894674d541d519
humanhash:	december-georgia-football-india
File name:	nSolicitarRelat.tar
Download:	download sample
Signature	DonutLoader Alert Create hunting rule
File size:	9'354'240 bytes
First seen:	2026-02-04 02:30:11 UTC
Last seen:	Never
File type:	tar
MIME type:	application/x-tar
ssdeep	49152:CMVl9BM+G08EBQIBbsVsUgEcdsNP9VzQGKzmLdWW/g183vDkEakp05:
TLSH	T131968DE33E6A01C8CB1C7FABE7129DCE31C4EE545A453C8AA7D5B6842B2634FD52C125
TrID	62.9% (.TAR/USTAR) TAR - Tape ARchive (POSIX) (17/3) 37.0% (.TAR) TAR - Tape ARchive (directory) (10/3)
Magika	tar
Reporter	FXOLabs
Tags:	donutloader tar

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

60

Origin country :

BR

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

Relevant files 1

File name:	SolicitarRelatórioVarejista_xlsx(~89.5 KB).cmd
File size:	9'350'565 bytes
SHA256 hash:	0274518332a65e1b27144a1d13bd607d3c1d5e31c3c7d989596f665c1d57b166
MD5 hash:	c1d8fb609ef47f64ad8d1da56ddcabe7
MIME type:	text/plain
Signature	DonutLoader

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

Porcupine.BAT.TrojanDropper.Agent.NKZ.490262.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

81.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6982af449a60ec70d92c9abc

Tags:

infosteal shell spawn sage

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

batch certutil lolbin wscript

Link:

https://www.filescan.io/uploads/6982af3f930564ff3c8861db/reports/cc8889d8-db63-4b13-93d9-dcef0267381e/overview

Hybrid Analysis Unknown

Verdict:

Suspicious

Link:

https://www.hybrid-analysis.com/sample/187d81b53d120b45f31c17f0db98ebf37ac70f3cfc5e4522dd33bc32cf19ad78

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

tar

First seen:

2026-01-27T14:23:00Z UTC

Last seen:

2026-02-04T10:42:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/187d81b53d120b45f31c17f0db98ebf37ac70f3cfc5e4522dd33bc32cf19ad78/results?tab=lookup

Nucleon Malprob Malware

Score:

74%

Verdict:

Malware

File Type:

ARCHIVE

Link:

https://malprob.io/report/187d81b53d120b45f31c17f0db98ebf37ac70f3cfc5e4522dd33bc32cf19ad78

Malva.RE inconclusive

Verdict:

inconclusive

YARA:

2 match(es)

Tags:

Tar Archive

Link:

https://app.malva.re/file/c8bd411a07dbb993a7894674d541d519

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/187d81b53d120b45f31c17f0db98ebf37ac70f3cfc5e4522dd33bc32cf19ad78/

Neiki Family.REMCOS

Verdict:

Malicious

Threat:

Family.REMCOS

Link:

https://tip.neiki.dev/file/187d81b53d120b45f31c17f0db98ebf37ac70f3cfc5e4522dd33bc32cf19ad78

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=db6ydnj5ciful4y4c7ynxghl6n5modz47rpekiw5go6dftyzvv4a._file

Hatching Triage donutloader

Result

Malware family:

donutloader

Alert

Create hunting rule

Score:

  10/10

Tags:

family:donutloader defense_evasion discovery execution loader

Link:

https://tria.ge/reports/260204-hfxa1afw6d/

Behaviour

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Deobfuscate/Decode Files or Information

Checks computer location settings

Executes dropped EXE

Detects DonutLoader

DonutLoader

Donutloader family

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/187d81b53d120b45f31c17f0db98ebf37ac70f3cfc5e4522dd33bc32cf19ad78