MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 76813f218da40285358e43a39a17d2e2bde45953106fced074fc6a1c3ccb4727. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

DonutLoader

Vendor detections: 9

Intelligence 9 IOCs YARA 2 File information Comments

SHA256 hash:	76813f218da40285358e43a39a17d2e2bde45953106fced074fc6a1c3ccb4727
SHA3-384 hash:	1533f7df8bbca05a62001978539d78de9390932b84d2d3067db2613e6806b28894e05c6bd15dc5592afb709b2e8da141
SHA1 hash:	45deaea0dd2513460212a9758c6eb2ec35ef67ab
MD5 hash:	ea8af673f3eb9f572924eb8e094be216
humanhash:	five-undress-delta-jersey
File name:	backgroundTaskHost.exe
Download:	download sample
Signature	DonutLoader Create hunting rule
File size:	1'508'672 bytes
First seen:	2026-10-12 10:07:32 UTC
Last seen:	Never
File type:	exe
MIME type:	application/vnd.microsoft.portable-executable
imphash	dc601e2593053a84a6989de251407aa7 (1 x DonutLoader)
ssdeep	24576:Elo3UjL2RUifwMajUwr30Geft9WHP7tWcc7a7QhZVqZuve:ElqALn7M0Z3xnHZbQPVq
TLSH	T1AF65331E11822615F706013E23CB99C19DFEEB636D6735F7BFDA1400A921ACC81B69F9
TrID	51.9% (.EXE) Win64 Executable (generic) (6522/11/2) 16.1% (.EXE) OS/2 Executable (generic) (2029/13) 15.9% (.EXE) Generic Win/DOS Executable (2002/3) 15.9% (.EXE) DOS Executable (generic) (2000/1)
Magika	pebin
Reporter	smica83
Tags:	exe

Intelligence

File Origin

# of uploads :

# of downloads :

242

Origin country :

Vendor Threat Intelligence

No detections

Malware family:

n/a

ID:

File name:

exe

Verdict:

Malicious activity

Analysis date:

2026-10-12 10:14:07 UTC

Tags:

arch-exec

Link:

https://app.any.run/tasks/4a5a0005-c7e1-4499-959c-bbd9cb14b73d

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/91533/

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6ad0f80e6f551121ba1616d5

Tags:

shellcode virus agent

Result

Verdict:

Clean

Maliciousness:

Behaviour

Creating a file in the %temp% subdirectories

Launching the default Windows debugger (dwwin.exe)

Sending a custom TCP request

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

expired-cert invalid-signature masquerade microsoft_visual_cc overlay packed signed

Link:

https://www.filescan.io/uploads/6accb18d7c6d96af999356ae/reports/6f3ae6fc-7c08-4f84-b97f-3e8abe60f809/overview

Verdict:

Malicious

Labled as:

VHO_Backdoor_Win32_Agent_gen

Link:

https://www.hybrid-analysis.com/sample/76813f218da40285358e43a39a17d2e2bde45953106fced074fc6a1c3ccb4727

Verdict:

Unknown

File Type:

exe x64

First seen:

2026-10-10T17:37:00Z UTC

Last seen:

2026-10-13T23:05:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/76813f218da40285358e43a39a17d2e2bde45953106fced074fc6a1c3ccb4727/results?tab=lookup

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/9d297412-e870-4ed7-bc25-3d361d777551

Result

Threat name:

n/a

Detection:

malicious

Classification:

n/a

Score:

48 / 100

Link:

https://www.joesandbox.com/analysis/1985857

Signature

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

Score:

Verdict:

Benign

File Type:

Link:

https://malprob.io/report/76813f218da40285358e43a39a17d2e2bde45953106fced074fc6a1c3ccb4727

Verdict:

inconclusive

YARA:

4 match(es)

Tags:

Executable PDB Path PE (Portable Executable) PE File Layout Win 64 Exe x64

Link:

https://app.malva.re/file/ea8af673f3eb9f572924eb8e094be216

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/76813f218da40285358e43a39a17d2e2bde45953106fced074fc6a1c3ccb4727/

Threat name:

Win64.Trojan.Qwexlafiba

Status:

Malicious

First seen:

2026-10-10 21:17:31 UTC

File Type:

PE+ (Exe)

Extracted files:

AV detection:

11 of 24 (45.83%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=o2at6imnuqbiknmoiorzuf6s4k66iwktcbx45udu7rvbypgli4tq._file

Result

Malware family:

n/a

Score:

5/10

Tags:

n/a

Link:

https://tria.ge/reports/261012-l6bc1azs3k/

Unpacked files

SH256 hash:

76813f218da40285358e43a39a17d2e2bde45953106fced074fc6a1c3ccb4727

MD5 hash:

ea8af673f3eb9f572924eb8e094be216

SHA1 hash:

45deaea0dd2513460212a9758c6eb2ec35ef67ab

Link:

https://www.unpac.me/results/bcf305d1-368d-48de-8422-ee8b13d870f0/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

0.70

Link:

https://yomi.yoroi.company/submissions/76813f218da40285358e43a39a17d2e2bde45953106fced074fc6a1c3ccb4727

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.