MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 41210a2ab3cee95a240a8d5df13176f78e73f449b6b1f26dee6554631cc905a5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DonutLoader


Vendor detections: 16


Intelligence 16 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 41210a2ab3cee95a240a8d5df13176f78e73f449b6b1f26dee6554631cc905a5
SHA3-384 hash: a64c3a6288e1688d8b494c9575abc49b3f6bd7dd65bd8ad9b658627f621ebbb1e3c44d98e231586ba099dc2eaa1dad8f
SHA1 hash: 4670e14e7f2e0eac5c9bef3cb09159ff0c712a2a
MD5 hash: 4db77d10134b7106476a810a92d4896d
humanhash: missouri-salami-table-sixteen
File name:41210a2ab3cee95a240a8d5df13176f78e73f449b6b1f26dee6554631cc905a5
Download: download sample
Signature DonutLoader
Create hunting rule
File size:21'504 bytes
First seen:2026-01-28 07:54:58 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 5567b8d80b91528b32e3af4cecffd666 (1 x DonutLoader)
ssdeep 384:RV26sHSpvKnr60TmyUL8v6QcYCjE3xM1e7:P26sH8vKnTvW8v6QcXKMA
Threatray 303 similar samples on MalwareBazaar
TLSH T1FBA2E70FB20394D8D81BC2749AE98373B5B1B81166676B2927E0C6710F60EEA5F39709
TrID 44.4% (.EXE) Win64 Executable (generic) (10522/11/4)
21.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
8.7% (.ICL) Windows Icons Library (generic) (2059/9)
8.5% (.EXE) OS/2 Executable (generic) (2029/13)
8.4% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
Reporter JAMESWT_WT
Tags:donutloader exe kid-lidiia-com-ua

Intelligence

File Origin
# of uploads :
1
# of downloads :
160
Origin country :
IT IT
Vendor Threat Intelligence
No detections
Malware family:
vidar
Create hunting rule
ID:
1
File name:
41210a2ab3cee95a240a8d5df13176f78e73f449b6b1f26dee6554631cc905a5
Verdict:
Malicious activity
Analysis date:
2026-01-28 07:55:52 UTC
Tags:
clickfix phishing stealer stealc vidar
Link:
https://app.any.run/tasks/02cddd04-40f7-47f8-89cf-420e03b75bfa

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/50469/
Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6979c0f1bec9764f452f84dd
Tags:
cobaltstrike emotet
Result
Verdict:
Malware
Maliciousness:
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-debug mingw packed
Link:
https://www.filescan.io/uploads/6979c0f14156786ccbdc4440/reports/e5479b0f-919a-452e-9387-27bda9551193/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/41210a2ab3cee95a240a8d5df13176f78e73f449b6b1f26dee6554631cc905a5
Verdict:
Malicious
File Type:
exe x64
First seen:
2026-01-18T08:19:00Z UTC
Last seen:
2026-01-30T06:22:00Z UTC
Hits:
~100
Detections:
Trojan-PSW.Lumma.HTTP.C&C Backdoor.Androm.HTTP.Download Trojan.Win32.Shellcode.sb HEUR:Trojan.Win64.Donut.a HEUR:Trojan.Multi.Donut.b Backdoor.Win32.Androm.walk
Link:
https://opentip.kaspersky.com/41210a2ab3cee95a240a8d5df13176f78e73f449b6b1f26dee6554631cc905a5/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/9f51512d-016d-4b05-a60f-4ebd81878dbb
Score:
90%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/41210a2ab3cee95a240a8d5df13176f78e73f449b6b1f26dee6554631cc905a5
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/41210a2ab3cee95a240a8d5df13176f78e73f449b6b1f26dee6554631cc905a5/
Verdict:
Malicious
Threat:
Family.DONUTLOADER
Link:
https://tip.neiki.dev/file/41210a2ab3cee95a240a8d5df13176f78e73f449b6b1f26dee6554631cc905a5
Threat name:
Win64.Malware.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2026-01-18 16:18:00 UTC
AV detection:
15 of 24 (62.50%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ieqqukvtz3uvujakrvo7cmlw66hhh5cjw2y7e3pomvkgghgjawsq._file
Verdict:
malicious
Label(s):
donutloader
Create hunting rule
Similar samples:
1bb4c84914707127007e6922b35319f142b56fe00ece18fc0c2fcd6e5e74c76a
DonutLoader
60c7a9b038702e8821008c1ed68e00d45fb57344fbaf169dc801775456b2c626
DonutLoader
6f0ef6c29679e765e8e71341d301cc946ec6d4e4679535dc872aacb254c9a85f
DonutLoader
8990f1f819501cac425a640eee2f499036797d4116c74fd61bcb47c420f11528
DonutLoader
8af432d7a2658aeb50f30d2e8a8ec325bb6005e2b198a483d5a3451ef30c9e97
DonutLoader
a0b1944382e2fdec5e5640f45b7841b95e9c93dfa3f4e4f02b603cf1f7e68222
DonutLoader
ec3cd7925635d26ea256f64eb24f30749cd4bc15335eb85eb3c3ca554b7818ab
DonutLoader
error
DonutLoader
f8f52d0c711638b4fa7071bc09255c9ea6d13afb10da5eeca36bde332f7c3b34
DonutLoader
+ 293 additional samples on MalwareBazaar
Result
Malware family:
donutloader
Create hunting rule
Score:
  10/10
Tags:
family:donutloader loader
Link:
https://tria.ge/reports/260128-jscykaf17a/
Behaviour
Modifies data under HKEY_USERS
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Drops file in System32 directory
Detects DonutLoader
DonutLoader
Donutloader family
Unpacked files
SH256 hash:
41210a2ab3cee95a240a8d5df13176f78e73f449b6b1f26dee6554631cc905a5
MD5 hash:
4db77d10134b7106476a810a92d4896d
SHA1 hash:
4670e14e7f2e0eac5c9bef3cb09159ff0c712a2a
Link:
https://www.unpac.me/results/029d1670-afac-4a6b-bf10-3823d82235de/
Malware family:
Vidar
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/41210a2ab3ce/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/41210a2ab3cee95a240a8d5df13176f78e73f449b6b1f26dee6554631cc905a5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:pe_detect_tls_callbacks
Create hunting rule

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/50469/

Comments