MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 518d6457e2d3e20e470f20b6399ce0f0ff5091dc6d2a0826d658247832ff4a8c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
DonutLoader
Vendor detections: 16
| SHA256 hash: | 518d6457e2d3e20e470f20b6399ce0f0ff5091dc6d2a0826d658247832ff4a8c |
|---|---|
| SHA3-384 hash: | cd07db96decf9ba2dc01ec34be71db34a27eae5334058e10ef916b436d08957676a3f61db162296969a7361d858bbeff |
| SHA1 hash: | 877288c78ad0fa0cb063dd5207b64cb5a7048d3f |
| MD5 hash: | 309a0013a20b269be627e07d29047042 |
| humanhash: | delta-johnny-minnesota-tango |
| File name: | donut.exe |
| Download: | download sample |
| Signature | DonutLoader |
| File size: | 206'336 bytes |
| First seen: | 2026-01-09 17:19:57 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 4970aa163a1343dca70c14d7acb4eef5 (1 x DonutLoader) |
| ssdeep | 3072:8Aw/9MUDuROBHrj/7QI/jZgsa6m8wOrqqBavGutmKjI23es8Yl3bIO:8bL0SLLL/tgxIwUijIGh8E |
| TLSH | T1DF147B56B7A420FAE8728234C951D716FF727C650330978F13A41AB6AF672E06D3DB90 |
| TrID | 48.7% (.EXE) Win64 Executable (generic) (10522/11/4) 23.3% (.EXE) Win16 NE executable (generic) (5038/12/1) 9.3% (.EXE) OS/2 Executable (generic) (2029/13) 9.2% (.EXE) Generic Win/DOS Executable (2002/3) 9.2% (.EXE) DOS Executable Generic (2000/1) |
| Magika | pebin |
| Reporter |  abuse_ch |
| Tags: | donutloader exe |
Intelligence
File Origin
# of uploads :
1
# of downloads :
93
Origin country :
SEVendor Threat Intelligence
No detections
Malware family:
amadey
ID:
1
File name:
2to1ep.exe
Verdict:
Malicious activity
Analysis date:
2026-01-09 15:22:00 UTC
Tags:
auto metasploit framework python stealer stealc powershell anti-evasion possible-phishing github clickfix phishing amadey botnet barys credentialflusher generic tool remcos rat guloader loader powershellempire purelogs njrat koistealer tinynuke networm amus koiloader cobaltstrike wannacry ransomware irc xred meterpreter asyncrat purecrypter bruteratel whitesnakestealer formbook coinminer miner ghostsocks proxyware stealerium redline svc havoc gh0st websocket pushware adware putty rmm-tool neshta xmrig xworm evasion bdaejec backdoor pyinstaller muckstealer donutloader dcrat lumma salatstealer screenconnect rdp clipper diamotrix azorult rustystealer quasar remote gh0stcringe pastebin offloader telegram whitesnake jeefo hijackloader eicar-test autohotkey darkcrystal pythonstealer discord meshagent anydesk braodo noescape wiper ramnit blankgrabber vidar
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Detection(s):
Verdict:
Malicious
Score:
96.5%
Tags:
shellcode virus
Result
Verdict:
Clean
Maliciousness:
Behaviour
DNS request
Connection attempt
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
anti-vm base64 crypto donut lolbin microsoft_visual_cc redcap wscript
Verdict:
Malicious
Labled as:
ShellCode.Donut.Marte.1.Generic
Verdict:
Malicious
File Type:
exe x64
First seen:
2020-02-26T23:34:00Z UTC
Last seen:
2026-01-10T12:48:00Z UTC
Hits:
~1000
Detections:
Trojan.Win64.DonutInjector.sb Trojan.Win64.Donut.sb Trojan.Win32.Shellcode.sb VHO:Trojan.Win64.Donut.gen VHO:Trojan.Win32.HTA.gen VHO:Trojan.Win64.Donut.kj BSS:Trojan.Win32.Generic Trojan.Win64.Donut.kj
Malware family:
Donut Injector
Verdict:
Malicious
Result
Threat name:
n/a
Detection:
malicious
Classification:
n/a
Score:
64 / 100
Signature
Antivirus / Scanner detection for submitted sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Score:
68%
Verdict:
Susipicious
File Type:
PE
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PDB Path PE (Portable Executable) PE File Layout Win 64 Exe x64
Verdict:
Malicious
Threat:
Family.DONUTLOADER
Threat name:
Win64.Exploit.DonutMarte
Status:
Malicious
First seen:
2020-01-28 03:24:00 UTC
File Type:
PE+ (Exe)
Extracted files:
2
AV detection:
24 of 36 (66.67%)
Threat level:
5/5
Detection(s):
Suspicious file
Result
Malware family:
donutloader
Score:
10/10
Tags:
family:donutloader loader
Verdict:
Malicious
Tags:
loader Win.Malware.Generic-9832686-0
YARA:
Windows_Trojan_Donutloader_f40e3759 Windows_Trojan_Donutloader_5c38878d
Unpacked files
SH256 hash:
518d6457e2d3e20e470f20b6399ce0f0ff5091dc6d2a0826d658247832ff4a8c
MD5 hash:
309a0013a20b269be627e07d29047042
SHA1 hash:
877288c78ad0fa0cb063dd5207b64cb5a7048d3f
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | cobalt_strike_tmp01925d3f |
|---|---|
| Author: | The DFIR Report |
| Description: | files - file ~tmp01925d3f.exe |
| Reference: | https://thedfirreport.com |
| Rule name: | DebuggerCheck__API |
|---|---|
| Reference: | https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara |
| Rule name: | golang_bin_JCorn_CSC846 |
|---|---|
| Author: | Justin Cornwell |
| Description: | CSC-846 Golang detection ruleset |
| Rule name: | NET |
|---|---|
| Author: | malware-lu |
| Rule name: | Windows_Trojan_Donutloader_5c38878d |
|---|---|
| Author: | Elastic Security |
| Rule name: | Windows_Trojan_Donutloader_f40e3759 |
|---|---|
| Author: | Elastic Security |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.