MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6aa5b8e6d045445c7063c422e997f20ee00a0cf1aec552cce52b5d06057ab4c6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DonutLoader


Vendor detections: 15


Intelligence 15 IOCs YARA 10 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6aa5b8e6d045445c7063c422e997f20ee00a0cf1aec552cce52b5d06057ab4c6
SHA3-384 hash: 298fba136dc3a2ff183471e9ea5c9e58122af37225c4d0b8f1e4cb804250b4d8aeb05bd889af1542390364efd5a81416
SHA1 hash: baab749d959ff040a79e6526395cbca042d42dcc
MD5 hash: aa2a4d8535411fca147b1ae5be0be3a7
humanhash: burger-lemon-twelve-neptune
File name:m9wPaPW.exe
Download: download sample
Signature DonutLoader
Create hunting rule
File size:3'524'170 bytes
First seen:2025-05-27 16:44:33 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash efd455830ba918de67076b7c65d86586 (56 x Gh0stRAT, 19 x ValleyRAT, 6 x OffLoader)
ssdeep 49152:txXXm66OSWTTzG1ujHaxqxpkSF2eOwLCXamClWo5BNseqmB+IE55z3jRJYRDNc:txHXS4e1K2QkYSamClWMBNQmBlET3A1y
TLSH T178F50127B2CB213FF07E4A364977E222593B7B616A128C6797E8085CCE260D51D3F647
TrID 60.0% (.EXE) Inno Setup installer (107240/4/30)
23.2% (.EXE) Win32 EXE PECompact compressed (generic) (41569/9/9)
5.8% (.EXE) Win64 Executable (generic) (10522/11/4)
3.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
2.5% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
dhash icon ccccc6e0d89acccc (2 x DonutLoader, 1 x ValleyRAT)
Reporter abuse_ch
Tags:donutloader exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
408
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
amadey
Create hunting rule
ID:
1
File name:
https://google.com
Verdict:
Malicious activity
Analysis date:
2025-05-27 09:51:35 UTC
Tags:
loader amadey botnet stealer rdp themida lumma telegram evasion hijackloader miner gcleaner rat asyncrat remote auto generic antivm rust
Link:
https://app.any.run/tasks/ff3b9034-dcaf-4747-b1c8-e0c850e22ba5

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/5907/
Verdict:
Malicious
Score:
98.2%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6835ed38acf88f5815e7a368
Tags:
asyncrat dropper extens virus
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a file in the %temp% subdirectories
Creating a window
Creating a process from a recently created file
Сreating synchronization primitives
Searching for synchronization primitives
Restart of the analyzed sample
Creating a process with a hidden window
Creating a file
Moving a recently created file
Launching a process
Creating a service
Launching a service
Creating a file in the Windows subdirectories
Creating a file in the system32 subdirectories
Connection attempt
Sending a custom TCP request
Enabling autorun for a service
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
embarcadero_delphi fingerprint installer invalid-signature overlay overlay packed signed
Link:
https://www.filescan.io/uploads/6835ec2d171e01f9592e9077/reports/45e7e0c1-abef-4adc-8996-b1ec78554217/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_70%
Link:
https://www.hybrid-analysis.com/sample/6aa5b8e6d045445c7063c422e997f20ee00a0cf1aec552cce52b5d06057ab4c6
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/2fea9a1a-09c2-4f7b-8cce-b847d0c0038b
Result
Threat name:
PureCrypter, ResolverRAT
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1700040
Signature
.NET source code contains potential unpacker
.NET source code contains very large array initializations
Detected PureCrypter Trojan
Found many strings related to Crypto-Wallets (likely being stolen)
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries memory information (via WMI often done to detect virtual machines)
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)
Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)
Sigma detected: Potentially Suspicious Child Process Of Regsvr32
Sigma detected: Potentially Suspicious PowerShell Child Processes
Sigma detected: Powershell launch regsvr32
Suricata IDS alerts for network traffic
Suspicious execution chain found
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal Bitcoin Wallet information
Yara detected ResolverRAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1700040 Sample: m9wPaPW.exe Startdate: 27/05/2025 Architecture: WINDOWS Score: 100 74 pki-goog.l.google.com 2->74 76 c.pki.goog 2->76 78 bg.microsoft.map.fastly.net 2->78 82 Suricata IDS alerts for network traffic 2->82 84 Malicious sample detected (through community Yara rule) 2->84 86 Multi AV Scanner detection for dropped file 2->86 88 8 other signatures 2->88 13 m9wPaPW.exe 2 2->13         started        16 rundll32.exe 2->16         started        signatures3 process4 file5 70 C:\Users\user\AppData\Local\...\m9wPaPW.tmp, PE32 13->70 dropped 18 m9wPaPW.tmp 3 4 13->18         started        21 rundll32.exe 4 16->21         started        25 regsvr32.exe 16->25         started        27 powershell.exe 7 16->27         started        process6 dnsIp7 60 C:\Users\user\AppData\Local\...\_setup64.tmp, PE32+ 18->60 dropped 29 m9wPaPW.exe 2 18->29         started        80 69.165.70.2, 49693, 56001 VPSQUANUS United States 21->80 102 System process connects to network (likely due to code injection or exploit) 21->102 104 Found many strings related to Crypto-Wallets (likely being stolen) 21->104 106 Tries to harvest and steal Bitcoin Wallet information 21->106 108 Detected PureCrypter Trojan 21->108 32 powershell.exe 25->32         started        34 conhost.exe 27->34         started        file8 signatures9 process10 file11 72 C:\Users\user\AppData\Local\...\m9wPaPW.tmp, PE32 29->72 dropped 36 m9wPaPW.tmp 23 10 29->36         started        40 conhost.exe 32->40         started        process12 file13 62 C:\Users\user\AppData\...\unins000.exe (copy), PE32 36->62 dropped 64 C:\Users\user\AppData\Local\is-DFN8R.tmp, PE32 36->64 dropped 66 C:\Users\user\AppData\Local\...\_setup64.tmp, PE32+ 36->66 dropped 68 8 other files (3 malicious) 36->68 dropped 90 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 36->90 42 powershell.exe 16 36->42         started        45 regsvr32.exe 36->45         started        signatures14 process15 signatures16 110 Suspicious execution chain found 42->110 47 rundll32.exe 42->47         started        49 conhost.exe 42->49         started        51 regsvr32.exe 45->51         started        process17 process18 53 rundll32.exe 47->53         started        56 powershell.exe 15 51->56         started        signatures19 92 Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines) 53->92 94 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 53->94 96 Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines) 53->96 98 Queries memory information (via WMI often done to detect virtual machines) 53->98 100 Found many strings related to Crypto-Wallets (likely being stolen) 56->100 58 conhost.exe 56->58         started        process20
Score:
40%
Verdict:
Susipicious
File Type:
PE
Link:
https://malprob.io/report/6aa5b8e6d045445c7063c422e997f20ee00a0cf1aec552cce52b5d06057ab4c6
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6aa5b8e6d045445c7063c422e997f20ee00a0cf1aec552cce52b5d06057ab4c6/
Threat name:
Win32.Trojan.Egairtigado
Create hunting rule
Status:
Malicious
First seen:
2025-05-27 10:06:36 UTC
File Type:
PE (Exe)
AV detection:
13 of 38 (34.21%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=nks3rzwqivcfy4ddyqrotf7sb3qaudhrv3cvfthffnoqmbl2wtda._file
Result
Malware family:
donutloader
Create hunting rule
Score:
  10/10
Tags:
family:donutloader defense_evasion discovery execution loader
Link:
https://tria.ge/reports/250527-t9nfqsdm2x/
Behaviour
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Hide Artifacts: Ignore Process Interrupts
Command and Scripting Interpreter: PowerShell
Drops file in System32 directory
Checks installed software on the system
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Blocklisted process makes network request
Detects DonutLoader
DonutLoader
Donutloader family
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/941fd7a9-7fb7-4993-a2e8-bdd1f1b0d612
Unpacked files
SH256 hash:
30f620f9dccbdcb460fb87568aa8254c8fa06730556902831698d7dbf0da1a9f
MD5 hash:
c7e505180af4bf2999406b91ca4f3c7d
SHA1 hash:
97a450ac6be25e20e15c6a2da73bfac819935029
Link:
https://www.unpac.me/results/d325e6ea-4a2c-4919-9dba-2ab26674b383/
SH256 hash:
e3ba4524a50f2e0ed907bd0747f913832d78fac000c5ad4aee759047423a8311
MD5 hash:
123ca6b024b2fd7546803ba2e6f8c0c6
SHA1 hash:
59ea1d400bd0218ce5129379b9a3a976f142a323
Detections:
INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
Create hunting rule
Link:
https://www.unpac.me/results/d325e6ea-4a2c-4919-9dba-2ab26674b383/
SH256 hash:
6aa5b8e6d045445c7063c422e997f20ee00a0cf1aec552cce52b5d06057ab4c6
MD5 hash:
aa2a4d8535411fca147b1ae5be0be3a7
SHA1 hash:
baab749d959ff040a79e6526395cbca042d42dcc
Link:
https://www.unpac.me/results/d325e6ea-4a2c-4919-9dba-2ab26674b383/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6aa5b8e6d045445c7063c422e997f20ee00a0cf1aec552cce52b5d06057ab4c6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Borland
Create hunting rule
Author:malware-lu
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:pe_imphash
Create hunting rule
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
Rule name:Windows_Trojan_Donutloader_f40e3759
Create hunting rule
Author:Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

DonutLoader

Executable exe 6aa5b8e6d045445c7063c422e997f20ee00a0cf1aec552cce52b5d06057ab4c6

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/5907/
  
URLhaus
https://urlhaus.abuse.ch/url/3553528/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3553579/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (FORCE_INTEGRITY)high
Reviews
IDCapabilitiesEvidence
AUTH_APIManipulates User AuthorizationADVAPI32.dll::GetSidSubAuthorityCount
ADVAPI32.dll::GetSidSubAuthority
ADVAPI32.dll::RevertToSelf
COM_BASE_APICan Download & Execute componentsole32.dll::CLSIDFromProgID
ole32.dll::CreateStreamOnHGlobal
SECURITY_BASE_APIUses Security Base APIADVAPI32.dll::AdjustTokenPrivileges
ADVAPI32.dll::GetTokenInformation
ADVAPI32.dll::SetKernelObjectSecurity
SHELL_APIManipulates System ShellSHELL32.dll::ShellExecuteW
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::CreateProcessW
ADVAPI32.dll::OpenProcessToken
ADVAPI32.dll::OpenThreadToken
ADVAPI32.dll::SetThreadToken
KERNEL32.dll::VirtualAllocExNuma
KERNEL32.dll::CloseHandle
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess
KERNEL32.dll::GetActiveProcessorGroupCount
KERNEL32.dll::LoadLibraryExW
KERNEL32.dll::LoadLibraryExA
KERNEL32.dll::LoadLibraryW
KERNEL32.dll::LoadLibraryA
WIN_BASE_EXEC_APICan Execute other programsKERNEL32.dll::SetConsoleCtrlHandler
KERNEL32.dll::GetConsoleOutputCP
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CreateDirectoryW
KERNEL32.dll::CreateFileMappingW
KERNEL32.dll::CreateFileW
KERNEL32.dll::CreateFileA
KERNEL32.dll::CreateFileMappingA
KERNEL32.dll::RemoveDirectoryW
WIN_BASE_USER_APIRetrieves Account InformationADVAPI32.dll::LookupPrivilegeValueW
WIN_REG_APICan Manipulate Windows RegistryADVAPI32.dll::RegGetValueW
ADVAPI32.dll::RegOpenKeyExW
ADVAPI32.dll::RegQueryValueExW

Comments