MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 76889ef23dc327c0a63da2e296e079ce1f6844da185c3160402341557e6bccfa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DonutLoader


Vendor detections: 16


Intelligence 16 IOCs YARA 8 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 76889ef23dc327c0a63da2e296e079ce1f6844da185c3160402341557e6bccfa
SHA3-384 hash: cab868791ceb4120f61dcd692aedba3a61b456111950c1960d32892c810237167e30ce91b180fbcb92647f67efcb9cf1
SHA1 hash: 36c2fcd1bab2de1d8e6b314c85db5f3526435b87
MD5 hash: e614214aa364a4f7c0f313326ae53966
humanhash: minnesota-bravo-yankee-glucose
File name:76889ef23dc327c0a63da2e296e079ce1f6844da185c3160402341557e6bccfa
Download: download sample
Signature DonutLoader
Create hunting rule
File size:4'877'152 bytes
First seen:2025-09-18 05:49:41 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 492a5d3560401c2811de048088bf91d0 (4 x DonutLoader, 2 x HijackLoader, 1 x QuasarRAT)
ssdeep 98304:QCgM2uaCFI1yDUq1P9WVyLX9gosleLGjJnr:3VTab1yhoyX9guLGp
TLSH T182362319EBA945F9E0A3D6B0DC928D52E7327C49477127DF279056E60F33AA08D3E312
TrID 92.4% (.EXE) WinRAR Self Extracting archive (4.x-5.x) (265042/9/39)
3.6% (.EXE) Win64 Executable (generic) (10522/11/4)
1.7% (.EXE) Win16 NE executable (generic) (5038/12/1)
0.7% (.EXE) OS/2 Executable (generic) (2029/13)
0.6% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
Reporter JAMESWT_WT
Tags:Art-en-Code-B-V donutloader exe signed

Code Signing Certificate

Organisation:Art en Code B.V.
Issuer:SSL.com EV Code Signing Intermediate CA RSA R3
Algorithm:sha256WithRSAEncryption
Valid from:2025-09-08T15:15:46Z
Valid to:2026-09-07T15:14:26Z
Serial number: 31d4015bd379f5dc18056f60d51a43cf
Intelligence: 4 malware samples on MalwareBazaar are signed with this code signing certificate
MalwareBazaar Blocklist:This certificate is on the MalwareBazaar code signing certificate blocklist (CSCB)
Cert Central Blocklist:This certificate is on the Cert Central blocklist
Thumbprint Algorithm:SHA256
Thumbprint: 23e8fb75941cabf2710fa769a5a3e1eb76d2bde7cdbea980c61da21819143f23
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
1
# of downloads :
78
Origin country :
IT IT
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
putty-64bit-0.83-installer.exe
Verdict:
Malicious activity
Analysis date:
2025-09-14 01:14:48 UTC
Tags:
oyster backdoor
Link:
https://app.any.run/tasks/7395cad2-cd1b-4eb9-8875-94da1cf1ec97

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/28037/
Verdict:
Malicious
Score:
90.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68cb9dbb243203254647615f
Tags:
dropper virus blic
Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Searching for the window
Сreating synchronization primitives
Searching for synchronization primitives
Creating a file
Creating a process from a recently created file
Launching a process
Connection attempt
Sending an HTTP GET request
Sending an HTTP POST request
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
donut fingerprint microsoft_visual_cc overlay overlay revoked-cert signed unsafe
Link:
https://www.filescan.io/uploads/68cb9db45ebd1d861ec4e4d8/reports/6c5457eb-df51-4612-8b11-4cb1c8c2d5f7/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/76889ef23dc327c0a63da2e296e079ce1f6844da185c3160402341557e6bccfa
Verdict:
Malicious
File Type:
exe x64
First seen:
2025-09-12T11:26:00Z UTC
Last seen:
2025-09-12T11:26:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/76889ef23dc327c0a63da2e296e079ce1f6844da185c3160402341557e6bccfa/results?tab=lookup
Malware family:
Microsoft Corporation
Create hunting rule
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/d87978d8-e961-4172-81c1-569d04aab291
Score:
75%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/76889ef23dc327c0a63da2e296e079ce1f6844da185c3160402341557e6bccfa
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PDB Path PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/e614214aa364a4f7c0f313326ae53966
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/76889ef23dc327c0a63da2e296e079ce1f6844da185c3160402341557e6bccfa/
Verdict:
Malicious
Threat:
Family.DONUTLOADER
Link:
https://tip.neiki.dev/file/76889ef23dc327c0a63da2e296e079ce1f6844da185c3160402341557e6bccfa
Threat name:
Win64.Trojan.Oysterloader
Create hunting rule
Status:
Malicious
First seen:
2025-09-12 18:39:04 UTC
File Type:
PE+ (Exe)
Extracted files:
731
AV detection:
19 of 38 (50.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=o2ej54r5ymt4bjr5ulrjnydzzypwqrg2dbodcycaenavk7tlzt5a._file
Verdict:
malicious
Label(s):
admintool_putty
Create hunting rule
Similar samples:
error
DonutLoader
Result
Malware family:
donutloader
Create hunting rule
Score:
  10/10
Tags:
family:donutloader discovery loader ransomware
Link:
https://tria.ge/reports/250918-gka3ws1xg1/
Behaviour
Checks SCSI registry key(s)
Modifies data under HKEY_USERS
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Uses Volume Shadow Copy service COM API
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Drops file in Program Files directory
Drops file in Windows directory
Badlisted process makes network request
Enumerates connected drives
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Detects DonutLoader
DonutLoader
Donutloader family
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/a9831a9e-f6b6-4f17-a1cd-624a3dde02f0
Unpacked files
SH256 hash:
76889ef23dc327c0a63da2e296e079ce1f6844da185c3160402341557e6bccfa
MD5 hash:
e614214aa364a4f7c0f313326ae53966
SHA1 hash:
36c2fcd1bab2de1d8e6b314c85db5f3526435b87
Link:
https://www.unpac.me/results/15269590-548b-4179-831a-e737eace5ef6/
SH256 hash:
0ca442e4c56aac7a875b27577ec2b22b4b33882281de60b534a2d204d106b264
MD5 hash:
a29f7a0b3a1cd4b859510bdce3f03305
SHA1 hash:
755f370af4810c10bc8a6e40d716bb4f8384365f
Link:
https://www.unpac.me/results/15269590-548b-4179-831a-e737eace5ef6/
SH256 hash:
fa3491a8a852c23592c5b2e75f7c2f3eb4863565f6376c969d88753efeb396bc
MD5 hash:
f8eb016c73be68ea1f8d2bea7cc90784
SHA1 hash:
23e572ea6eb98d93a1a9b553e903cdb644aa93c1
Link:
https://www.unpac.me/results/15269590-548b-4179-831a-e737eace5ef6/
Malware family:
DonutLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/76889ef23dc3/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/76889ef23dc327c0a63da2e296e079ce1f6844da185c3160402341557e6bccfa

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_AllMal_Detector
Create hunting rule
Author:DiegoAnalytics
Description:CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/28037/

Comments