MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 74aa6af4ce1d1d9331a9d11155ec94c59aed8e773fee15932e46439b6846dd1a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 13


Intelligence 13 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 74aa6af4ce1d1d9331a9d11155ec94c59aed8e773fee15932e46439b6846dd1a
SHA3-384 hash: e7e1c293ec39c081aa6cf565f00a5e484c8a5ea5039d6a3ad5eed17f915ddd54b53586ba19888a71869a5bb83e3af469
SHA1 hash: 630d511334e014fe3afc524acb0f1dc2658dffed
MD5 hash: 79ffba76fb28be6dca5ccd56e41916b0
humanhash: butter-pizza-tango-happy
File name:file
Download: download sample
File size:331'264 bytes
First seen:2025-12-30 08:37:42 UTC
Last seen:2025-12-30 10:19:23 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 79ec8dd48d5c183f7c338980a4a06c2e (1 x DonutLoader)
ssdeep 6144:f7mWkCtnjHnE14Y9dhlDTkHk7UNidRyOtM/+O6UCUO4faTRNP:fSTsjHE1t9dNP7tu+gdZfaTRN
Threatray 2'075 similar samples on MalwareBazaar
TLSH T190642384442EC0B6D9AEE4FCF413217D13E97AB2B1B1CDDA640A0F597C90B8925F6CA5
TrID 38.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
15.6% (.ICL) Windows Icons Library (generic) (2059/9)
15.4% (.EXE) OS/2 Executable (generic) (2029/13)
15.2% (.EXE) Generic Win/DOS Executable (2002/3)
15.2% (.EXE) DOS Executable Generic (2000/1)
Magika pebin
Reporter Bitsight
Tags:dropped-by-amadey exe fbf543


Avatar
Bitsight
url: http://130.12.180.43/files/6723359323/rVTgCy8.exe

Intelligence

File Origin
# of uploads :
5
# of downloads :
85
Origin country :
US US
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
http://130.12.180.43/files/6723359323/rVTgCy8.exe
Verdict:
Suspicious activity
Analysis date:
2025-12-30 08:33:23 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/543a1b9e-d51b-4b07-8771-1f0a6be8d377

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/46526/
Detection(s):
SecuriteInfo.com.Variant.Application.Lazy.2772.31466.4225.UNOFFICIAL
Create hunting rule

Verdict:
Clean
Score:
89.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=69538f777d915bf1778ee669
Tags:
n/a
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-debug explorer hacktool lolbin masm packed unsafe
Link:
https://www.filescan.io/uploads/69538f768d1aa9829e270af8/reports/a091737d-f592-4c66-9e39-8fa4e60fbfa7/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/74aa6af4ce1d1d9331a9d11155ec94c59aed8e773fee15932e46439b6846dd1a
Verdict:
Malicious
File Type:
exe x64
First seen:
2025-12-30T05:32:00Z UTC
Last seen:
2025-12-30T11:55:00Z UTC
Hits:
~10
Detections:
Trojan.Win64.DonutInjector.sb Trojan.Win64.Donut.sb Trojan.Win32.Shellcode.sb Trojan-PSW.Win32.Coins.sb Trojan-PSW.Win32.Agent.sb Trojan-PSW.MSIL.Stealer.sb MEM:Trojan.Win64.Cometer.gen VHO:Backdoor.MSIL.Convagent.gen Trojan.Win64.Agentb.sb MEM:Trojan.Win64.Shellcode.gen HEUR:Trojan.Win64.Donut.a HEUR:Trojan.Multi.Donut.b VHO:Trojan.Win64.Kryptik.gen Trojan.Win32.Shellcode.kjt MEM:Trojan.Win64.Shellcode.a
Link:
https://opentip.kaspersky.com/74aa6af4ce1d1d9331a9d11155ec94c59aed8e773fee15932e46439b6846dd1a/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/1e088508-d838-4739-902d-d92a790ca332
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/74aa6af4ce1d1d9331a9d11155ec94c59aed8e773fee15932e46439b6846dd1a
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PDB Path PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/79ffba76fb28be6dca5ccd56e41916b0
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/74aa6af4ce1d1d9331a9d11155ec94c59aed8e773fee15932e46439b6846dd1a/
Verdict:
Malicious
Threat:
Trojan.Win64.Shellcode
Link:
https://tip.neiki.dev/file/74aa6af4ce1d1d9331a9d11155ec94c59aed8e773fee15932e46439b6846dd1a
Threat name:
Win64.Packed.Generic
Create hunting rule
Status:
Suspicious
First seen:
2025-12-30 08:38:16 UTC
File Type:
PE+ (Exe)
AV detection:
11 of 36 (30.56%)
Threat level:
  1/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=osvgv5goduozgmnj2eivl3euywno3dtxh7xblezoizbzw2cg3una._file
Verdict:
malicious
Label(s):
evelynstealer
Create hunting rule
donutloader
Create hunting rule
Similar samples:
0f5d52e0b104dc37a4b8832bb9a691f1f42bc90589faf62a58281a8f59a881f0
390541226b54f5365b3e9f0cc115cc050be5d269d8ad5973ef48871300c0babb
43b63f7ecdf8fc8f25fe1ebb961596446f23f79752da4a1c0d7242ccd61dc73f
50419b6ae38000b3d639e462f69bb35ff167650ca8eff6eb35dcfbd38b08c393
5228cdea84a04c9047fd321efcde0b729a7b2fb036328f8c68c4379ea50c9f9a
5731d0fec3b864f35d7711803d93db4b80cde7a52bc81d89053ad11c0ac9f10c
878c2fd49c39b041dcd87701bfa3d32362103e2411a5310e74d1fc878f310c67
d08e8968930fb7f11e35db8b873e299a3851690b5961561997796c050cc75e46
error
+ 2'065 additional samples on MalwareBazaar
Gathering data
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/b4ecfbb9-c8a6-4a53-aa6c-0127903f4440
Unpacked files
SH256 hash:
74aa6af4ce1d1d9331a9d11155ec94c59aed8e773fee15932e46439b6846dd1a
MD5 hash:
79ffba76fb28be6dca5ccd56e41916b0
SHA1 hash:
630d511334e014fe3afc524acb0f1dc2658dffed
Link:
https://www.unpac.me/results/094dfbed-7db7-4ff9-8f4f-8e023a464f08/
Malware family:
DonutLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/74aa6af4ce1d/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/74aa6af4ce1d1d9331a9d11155ec94c59aed8e773fee15932e46439b6846dd1a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe 74aa6af4ce1d1d9331a9d11155ec94c59aed8e773fee15932e46439b6846dd1a

(this sample)

  
Dropped by
Amadey
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/46526/
  
URLhaus
https://urlhaus.abuse.ch/url/3746266/

Comments