MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2fe9a15186a8df77788fec0f6c8e5c52f99686b9f84e1ff139b8ff052308bffa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 5

Intelligence 5 IOCs YARA 2 File information Comments

SHA256 hash:	2fe9a15186a8df77788fec0f6c8e5c52f99686b9f84e1ff139b8ff052308bffa
SHA3-384 hash:	1bd9c3712b049cb6faae96ac813e279b7771cb85e45947cb332f521316e46beb04da49d281f23531b2e008fc8ed67707
SHA1 hash:	290b2f2fb17f69a78b6731321bc502fab875b148
MD5 hash:	b740f5ea550f2e5e892c3c6b8473ef12
humanhash:	pizza-wisconsin-arizona-beryllium
File name:	file_3.bin
Download:	download sample
File size:	178'155 bytes
First seen:	2025-03-07 16:26:55 UTC
Last seen:	Never
File type:	unknown
MIME type:	application/octet-stream
ssdeep	3072:0yrt7z0hVreV+ZB2e1MqiObY+A3EfbB9x5ih+J8wZ1BGUh/JZh6AhO7CUzcS7DZj:rrtshpB2XQm3Ef95ik8wxGUrZwAAXX7x
TLSH	T14E041292F7A780D9B9509420E920F95FFBB531D9A880B6C3BF14092657B39303D6D6CE
Magika	unknown
Reporter	aachum
Tags:	donutloader

iamaachum

https://api.telegram.org/file/bot7446828960:AAEkc-o_ddrGi8YykO2bp5LRB5CeoyXbG8w/documents/file_3.bin

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

donut masquerade

Link:

https://www.filescan.io/uploads/67cb1e653e7c969dcac64e13/reports/aaf333ee-ac33-4078-a6d6-529f2fc0342c/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/2fe9a15186a8df77788fec0f6c8e5c52f99686b9f84e1ff139b8ff052308bffa

Result

Verdict:

MALICIOUS

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/2fe9a15186a8df77788fec0f6c8e5c52f99686b9f84e1ff139b8ff052308bffa/

Gathering data

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=f7u2cumgvdpxo6ep5qhwzds4kl4znbvz7bhb74jzxd7qkiyix75a._file

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/2fe9a15186a8df77788fec0f6c8e5c52f99686b9f84e1ff139b8ff052308bffa

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)