MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c32463a16339b50b593ebfbb50602598d4f09ff3612e25b49444ba01dfd27d94. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DonutLoader


Vendor detections: 15


Intelligence 15 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c32463a16339b50b593ebfbb50602598d4f09ff3612e25b49444ba01dfd27d94
SHA3-384 hash: 98b18a62bb904ee6196e40f40707f87ca3a336f131c2d88f9b5a2650e1709973b1e5499933918c8596d27bd5b7f45433
SHA1 hash: c120b2fb76ce910f99cc536d3b70a1af82733976
MD5 hash: 3b579f26404f83f19ce44a0142d5ffd7
humanhash: september-video-music-mobile
File name:SecuriteInfo.com.Trojan.Packed2.49365.3421.30139
Download: download sample
Signature DonutLoader
Create hunting rule
File size:1'048'576 bytes
First seen:2025-11-05 16:18:37 UTC
Last seen:2025-11-05 17:32:53 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 4ee1a6456f7ed7de8beffa6389d76874 (3 x DonutLoader, 1 x Rhadamanthys)
ssdeep 3072:7gPoDgu8V8GdjRMyF6/bX414H0qJ9oY4Z2mMM:d0u8V8G/3FcbXb/oh0R
TLSH T189255A5B72A534F9E1774134C8A21A42F7B2B47517719BBF07A0877A1E232E08D3EB61
TrID 48.7% (.EXE) Win64 Executable (generic) (10522/11/4)
23.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
9.3% (.EXE) OS/2 Executable (generic) (2029/13)
9.2% (.EXE) Generic Win/DOS Executable (2002/3)
9.2% (.EXE) DOS Executable Generic (2000/1)
Magika pebin
Reporter SecuriteInfoCom
Tags:donutloader exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
104
Origin country :
FR FR
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
c32463a16339b50b593ebfbb50602598d4f09ff3612e25b49444ba01dfd27d94.bin.exe
Verdict:
No threats detected
Analysis date:
2025-11-05 15:42:31 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/3e0f679d-544c-4f80-8e7b-134e2a58931e

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/35544/
Detection(s):
SecuriteInfo.com.Trojan.Packed2.49365.3421.30139.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=690b7905ea0f3e915c2331f8
Tags:
shellcode dropper trojan zbot
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file
DNS request
Connection attempt
Creating a window
Connecting to a non-recommended domain
Sending an HTTP GET request
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
anti-vm base64 microsoft_visual_cc overlay
Link:
https://www.filescan.io/uploads/690b790385b61a93a73822d6/reports/619fb7df-a2fb-412d-b216-fbd0d2801387/overview
Verdict:
Malicious
Labled as:
Midie.Generic
Link:
https://www.hybrid-analysis.com/sample/c32463a16339b50b593ebfbb50602598d4f09ff3612e25b49444ba01dfd27d94
Verdict:
Malicious
File Type:
exe x64
First seen:
2025-11-05T12:58:00Z UTC
Last seen:
2025-11-05T13:02:00Z UTC
Hits:
~10
Detections:
Trojan.Win64.Agentb.sb Trojan.Win32.Shellcode.hfe PDM:Trojan.Win32.Generic Trojan.Win32.Shellcode.sb HEUR:Trojan.Win64.Donut.a HEUR:Trojan.Multi.Donut.b Trojan.Win64.SBEscape.sb
Link:
https://opentip.kaspersky.com/c32463a16339b50b593ebfbb50602598d4f09ff3612e25b49444ba01dfd27d94/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/2cbd533f-56a6-445b-bfc7-54fde5567075
Score:
96%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/c32463a16339b50b593ebfbb50602598d4f09ff3612e25b49444ba01dfd27d94
Verdict:
inconclusive
YARA:
3 match(es)
Tags:
Executable PDB Path PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/3b579f26404f83f19ce44a0142d5ffd7
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c32463a16339b50b593ebfbb50602598d4f09ff3612e25b49444ba01dfd27d94/
Verdict:
Malicious
Threat:
Family.DONUTLOADER
Link:
https://tip.neiki.dev/file/c32463a16339b50b593ebfbb50602598d4f09ff3612e25b49444ba01dfd27d94
Threat name:
Win64.Trojan.Egairtigado
Create hunting rule
Status:
Malicious
First seen:
2025-11-05 15:42:33 UTC
File Type:
PE+ (Exe)
Extracted files:
1
AV detection:
19 of 24 (79.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ymsghildhg2qwwj6x65vaybftdkpbh7tmexclneuis5adx6spwka._file
Verdict:
malicious
Label(s):
rhadamanthys
Create hunting rule
smokeloader
Create hunting rule
donutloader
Create hunting rule
Similar samples:
error
DonutLoader
Result
Malware family:
donutloader
Create hunting rule
Score:
  10/10
Tags:
family:donutloader collection discovery loader
Link:
https://tria.ge/reports/251105-tslktawlaj/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Modifies data under HKEY_USERS
Modifies registry class
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Browser Information Discovery
Drops file in Windows directory
Accesses Microsoft Outlook profiles
Detects DonutLoader
DonutLoader
Donutloader family
Suspicious use of NtCreateUserProcessOtherParentProcess
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/6b39c128-5761-43a7-9022-bdc8c00be9a6
Unpacked files
SH256 hash:
c32463a16339b50b593ebfbb50602598d4f09ff3612e25b49444ba01dfd27d94
MD5 hash:
3b579f26404f83f19ce44a0142d5ffd7
SHA1 hash:
c120b2fb76ce910f99cc536d3b70a1af82733976
Link:
https://www.unpac.me/results/831d2b08-647d-41d7-b77c-c93bab7ac177/
Malware family:
DonutLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/c32463a16339/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c32463a16339b50b593ebfbb50602598d4f09ff3612e25b49444ba01dfd27d94

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

DonutLoader

Executable exe c32463a16339b50b593ebfbb50602598d4f09ff3612e25b49444ba01dfd27d94

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/35544/
  
URLhaus
https://urlhaus.abuse.ch/url/3697214/
  
Delivery method
Distributed via web download

Comments