MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7bd1a323e9a3b32c257589cd85abe3064d97dadb3cbc24096a7e946e79a22df1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DonutLoader


Vendor detections: 16


Intelligence 16 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7bd1a323e9a3b32c257589cd85abe3064d97dadb3cbc24096a7e946e79a22df1
SHA3-384 hash: 8912948ecfb3fb45a91c55b4d6b04196af364b47422356e7f3808274aa64e533120d99ed5aeda5df166846c811e2cde5
SHA1 hash: f8d77ddfea3483a643c8eee7cdd22c959873462a
MD5 hash: 81ff06bb12cb3bfbf8b619a0f14004ee
humanhash: zulu-three-lamp-utah
File name:SecuriteInfo.com.Win64.MalwareX-gen.61299534
Download: download sample
Signature DonutLoader
Create hunting rule
File size:139'264 bytes
First seen:2025-11-20 09:13:49 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 073dd26d517108ec052956158ee6e659 (2 x DonutLoader)
ssdeep 3072:81TGZrLcgm8tuh3pqPZQY10gp3rmio4JTND7aFWG:8A0d8tufqGY1Vp3aat+
Threatray 17 similar samples on MalwareBazaar
TLSH T137D35B9B72E530FCE07B8539C9920A05FB72B87657615BEF03A4426A1F232D09D3DB61
TrID 44.4% (.EXE) Win64 Executable (generic) (10522/11/4)
21.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
8.7% (.ICL) Windows Icons Library (generic) (2059/9)
8.5% (.EXE) OS/2 Executable (generic) (2029/13)
8.4% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
Reporter SecuriteInfoCom
Tags:donutloader exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
120
Origin country :
FR FR
Vendor Threat Intelligence
Malware family:
redline
Create hunting rule
ID:
1
File name:
http://178.16.55.189:80/testmine/random.exe
Verdict:
Malicious activity
Analysis date:
2025-11-16 16:51:11 UTC
Tags:
auto redline stealer amadey botnet loader rdp github evasion anti-evasion valkyrie gcleaner stealc generic vidar xor-url upx themida antivm ip-check miner xmrig winring0-sys vuln-driver svitstealer
Link:
https://app.any.run/tasks/4382b467-418f-4389-b078-ca4aab6bdd2f

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/38823/
Detection(s):
SecuriteInfo.com.Win64.MalwareX-gen.61299534.UNOFFICIAL
Create hunting rule

Verdict:
Clean
Score:
N/A%
Link:
https://cyber-fortress.com/docs/result/index.php?id=691edbf88cf6736ec0af9dd5
Tags:
n/a
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file
Creating a window
Connection attempt
Sending an HTTP GET request
Сreating synchronization primitives
Sending an HTTP POST request
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
anti-vm microsoft_visual_cc redcap
Link:
https://www.filescan.io/uploads/691edbf9c5f3061c4067a4fd/reports/2cd35a4f-6541-4a83-87fb-ac2e174c21c2/overview
Verdict:
Malicious
Labled as:
Win64/ShellcodeRunner.HJ trojan
Link:
https://www.hybrid-analysis.com/sample/7bd1a323e9a3b32c257589cd85abe3064d97dadb3cbc24096a7e946e79a22df1
Verdict:
Malicious
File Type:
exe x64
First seen:
2025-11-16T14:22:00Z UTC
Last seen:
2025-11-20T17:28:00Z UTC
Hits:
~100
Detections:
PDM:Trojan.Win32.Generic Trojan.Win32.Shellcode.iau VHO:Trojan-PSW.Win32.Stealer.gen Trojan-PSW.Lumma.HTTP.C&C Trojan.Win64.Agentb.sb Trojan.Win32.Shellcode.sb
Link:
https://opentip.kaspersky.com/7bd1a323e9a3b32c257589cd85abe3064d97dadb3cbc24096a7e946e79a22df1/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/274799e7-a6a5-4853-b510-24558d8645f0
Score:
97%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/7bd1a323e9a3b32c257589cd85abe3064d97dadb3cbc24096a7e946e79a22df1
Verdict:
inconclusive
YARA:
3 match(es)
Tags:
Executable PDB Path PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/81ff06bb12cb3bfbf8b619a0f14004ee
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7bd1a323e9a3b32c257589cd85abe3064d97dadb3cbc24096a7e946e79a22df1/
Verdict:
Malicious
Threat:
Family.DONUTLOADER
Link:
https://tip.neiki.dev/file/7bd1a323e9a3b32c257589cd85abe3064d97dadb3cbc24096a7e946e79a22df1
Threat name:
Win64.Infostealer.Tinba
Create hunting rule
Status:
Malicious
First seen:
2025-11-16 18:10:28 UTC
File Type:
PE+ (Exe)
AV detection:
18 of 24 (75.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ppi2gi7juozsyjlvrhgylk7dazgzpww3hs6ciclkp2kg46ncfxyq._file
Verdict:
malicious
Label(s):
donutloader
Create hunting rule
shellcode_loader_007
Create hunting rule
stealc
Create hunting rule
Similar samples:
0f5d52e0b104dc37a4b8832bb9a691f1f42bc90589faf62a58281a8f59a881f0
DonutLoader
745f67eb3c497e12e17886a4b68255e41e5b1c00714c79f0502c139d36acb278
DonutLoader
75ce93e3a94ae6ed9288f61d8c7c3b56a7628e022fc51af45b0f5e1a321fe2e9
DonutLoader
ae525cc8316e04ab303e21633e179ff833f32123d61a8b2a35f62858e25b60aa
DonutLoader
b98b53ca03e3e9009b31bcc37b90b206064b25effce449dde63c51cef6a47470
DonutLoader
c36d6aa31395cdae0a5623dd10984e235a6986d61d4f7e1db0849f88000cfc01
DonutLoader
error
DonutLoader
fb790e2db7ebb409abb155124f071c94f9e9275f17f277ca842d1bf9bded4940
DonutLoader
+ 7 additional samples on MalwareBazaar
Result
Malware family:
donutloader
Create hunting rule
Score:
  10/10
Tags:
family:donutloader discovery loader spyware stealer
Link:
https://tria.ge/reports/251120-k7k36adr91/
Behaviour
Checks processor information in registry
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Checks computer location settings
Reads user/profile data of web browsers
Badlisted process makes network request
Detects DonutLoader
DonutLoader
Donutloader family
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/25f6013f-5d7a-4722-b06b-374a153d44ba
Unpacked files
SH256 hash:
7bd1a323e9a3b32c257589cd85abe3064d97dadb3cbc24096a7e946e79a22df1
MD5 hash:
81ff06bb12cb3bfbf8b619a0f14004ee
SHA1 hash:
f8d77ddfea3483a643c8eee7cdd22c959873462a
Link:
https://www.unpac.me/results/bf9516c6-1408-4635-adc9-66a4abde4bb4/
Malware family:
DonutLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/7bd1a323e9a3/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7bd1a323e9a3b32c257589cd85abe3064d97dadb3cbc24096a7e946e79a22df1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

DonutLoader

Executable exe 7bd1a323e9a3b32c257589cd85abe3064d97dadb3cbc24096a7e946e79a22df1

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3712357/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/38823/

Comments