🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2fb29f7b8d2c02d956f1e1e1fc7eb26789130b80ae1ec06f9b04cc5bc56f06f2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DonutLoader


Vendor detections: 10


Intelligence 10 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2fb29f7b8d2c02d956f1e1e1fc7eb26789130b80ae1ec06f9b04cc5bc56f06f2
SHA3-384 hash: 4ef7de779448f6d8e14c15a1dccdbd019072191a5be4fa07dea689b29dafe3877386740554726b1476093ecddcf97589
SHA1 hash: 5485e797c944f9349098cee573850bf5fdd0e163
MD5 hash: 26ca10cdd07b4824c4bbdf39aed2ef06
humanhash: alaska-virginia-autumn-green
File name:Verginia.cmd
Download: download sample
Signature DonutLoader
Create hunting rule
File size:142'551 bytes
First seen:2026-10-10 20:02:23 UTC
Last seen:Never
File type:cmd cmd
MIME type:text/x-msdos-batch
ssdeep 3072:aiKy02VvSV+xrtoYLdJu1M1EdX7As+osIejtLZ85ZJO6:BhSV+xtbLdiM1EwXsJO6
TLSH T1D7D36F4C6D853C4F46E19265F3AA7BFF26D8E3FBF6D7028D28056E0402A6688D1CD45B
Magika batch
Reporter smica83
Tags:cmd donutloader

Intelligence

File Origin
# of uploads :
1
# of downloads :
107
Origin country :
HU HU
Vendor Threat Intelligence
Malware configuration found for:
BatchScript
Details
Link:
https://research.acce.ciphertechsolutions.com/results/e9313b92-dbe0-4ba7-8f65-2e9b9f625f1c/
Verdict:
Malicious
Score:
94.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ad0b3366f551121ba15f772
Tags:
dropper shell sage
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
cmd explorer lolbin powershell
Link:
https://www.filescan.io/uploads/6aca9a061b8dd08584b4a076/reports/f66019a4-a011-4976-a353-d7acb3c45c9e/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/2fb29f7b8d2c02d956f1e1e1fc7eb26789130b80ae1ec06f9b04cc5bc56f06f2
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-10-10T18:18:00Z UTC
Last seen:
2026-10-11T19:24:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/2fb29f7b8d2c02d956f1e1e1fc7eb26789130b80ae1ec06f9b04cc5bc56f06f2/results?tab=lookup
Result
Threat name:
KeyLogger
Create hunting rule
Detection:
malicious
Classification:
rans.troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1985357
Signature
Bypasses PowerShell execution policy
Creates an autostart registry key pointing to binary in C:\Windows
Creates multiple autostart registry keys
Deletes shadow drive data (may be related to ransomware)
Drops VBS files to the startup folder
Found direct / indirect Syscall (likely to bypass EDR)
Found pyInstaller with non standard icon
Found suspicious powershell code related to unpacking or dynamic code loading
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Powershell connects to network
Powershell drops PE file
Sigma detected: Drops script at startup location
Sigma detected: Schedule VBS From Appdata
Sigma detected: Script Interpreter Execution From Suspicious Folder
Sigma detected: Suspicious Command Patterns In Scheduled Task Creation
Sigma detected: Suspicious Script Execution From Temp Folder
Sigma detected: WScript or CScript Dropper
Suspicious powershell command line found
Switches to a custom stack to bypass stack traces
Unusual module load detection (module proxying)
Uses netsh to modify the Windows network and firewall settings
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected Keylogger Generic
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1985357 Sample: Verginia.cmd Startdate: 10/10/2026 Architecture: WINDOWS Score: 100 66 expirience.click 2->66 78 Malicious sample detected (through community Yara rule) 2->78 80 Sigma detected: Schedule VBS From Appdata 2->80 82 Yara detected Keylogger Generic 2->82 84 6 other signatures 2->84 11 cmd.exe 3 2->11         started        15 wscript.exe 2->15         started        17 wscript.exe 2->17         started        19 6 other processes 2->19 signatures3 process4 file5 56 C:\Users\user\AppData\Local\Temp\...\boot.ps1, ASCII 11->56 dropped 94 Suspicious powershell command line found 11->94 96 Bypasses PowerShell execution policy 11->96 21 powershell.exe 13 11->21         started        25 conhost.exe 11->25         started        signatures6 process7 file8 54 C:\Users\user\AppData\Local\...\installer.ps1, Unicode 21->54 dropped 86 Uses netsh to modify the Windows network and firewall settings 21->86 88 Found suspicious powershell code related to unpacking or dynamic code loading 21->88 90 Found pyInstaller with non standard icon 21->90 92 Powershell drops PE file 21->92 27 powershell.exe 14 44 21->27         started        signatures9 process10 dnsIp11 68 expirience.click 78.17.209.207, 443, 49708, 49711 HOSTKEY-ASNL Finland 27->68 58 C:\Users\user\AppData\...\vcruntime140_1.dll, PE32+ 27->58 dropped 60 C:\Users\user\AppData\...\vcruntime140.dll, PE32+ 27->60 dropped 62 C:\Users\user\AppData\Local\...\sqlite3.dll, PE32+ 27->62 dropped 64 15 other malicious files 27->64 dropped 98 Powershell connects to network 27->98 32 pythonw.exe 2 55 27->32         started        36 netsh.exe 2 27->36         started        file12 signatures13 process14 file15 46 C:\Users\user\AppData\Roaming\...\run.vbs, ASCII 32->46 dropped 48 C:\Users\user\AppData\Roaming\...\ovl2.vbs, ASCII 32->48 dropped 50 C:\Users\user\AppData\Roaming\...\ovl.vbs, ASCII 32->50 dropped 52 37 other files (1 malicious) 32->52 dropped 70 Drops VBS files to the startup folder 32->70 72 Creates multiple autostart registry keys 32->72 74 Deletes shadow drive data (may be related to ransomware) 32->74 76 5 other signatures 32->76 38 schtasks.exe 32->38         started        40 schtasks.exe 32->40         started        signatures16 process17 process18 42 conhost.exe 38->42         started        44 conhost.exe 40->44         started       
Score:
70%
Verdict:
Susipicious
File Type:
SCRIPT
Link:
https://malprob.io/report/2fb29f7b8d2c02d956f1e1e1fc7eb26789130b80ae1ec06f9b04cc5bc56f06f2
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2fb29f7b8d2c02d956f1e1e1fc7eb26789130b80ae1ec06f9b04cc5bc56f06f2/
Threat name:
Win32.Trojan.Qwexlafiba
Create hunting rule
Status:
Malicious
First seen:
2026-10-10 14:39:48 UTC
File Type:
Text (Batch)
AV detection:
6 of 24 (25.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=f6zj664nfqbnsvxr4hq7y7vsm6ergc4avypma343atgfxrlpa3za._file
Result
Malware family:
donutloader
Create hunting rule
Score:
  10/10
Tags:
family:donutloader discovery execution loader persistence privilege_escalation
Link:
https://tria.ge/reports/261010-yssfkszzcv/
Behaviour
Checks processor information in registry
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Event Triggered Execution: Netsh Helper DLL
Executes a command shell one-liner
Reads the TCP/IP host and domain name from the registry
Executes a VBScript file via the Windows Script Host.
Adds Run key to start application
Creates a file in the Startup directory
Executes dropped EXE
Loads dropped DLL
Badlisted process makes network request
Command and Scripting Interpreter: PowerShell
Detects DonutLoader
Family: DonutLoader
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Base64_Encoded_Powershell_Directives
Create hunting rule
Rule name:SCRIPT_Dropper_Unknown_ForgeAuto_aaa464f7
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (script_js, etat binaire)
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments