MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cc0c1238db8928b8f82b51d3ed8ab25b5a60373c2a68eaa4c2e707adc664cd43. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	cc0c1238db8928b8f82b51d3ed8ab25b5a60373c2a68eaa4c2e707adc664cd43
SHA3-384 hash:	a8ac1a6c40f24c168d9e10d74ef8c9bb9030e17c41712832a7f39ee6f578a1518fc65c9e014f1d31e43a5ef84b60a188
SHA1 hash:	e0bdc44a523402ca037b93e736fb647c98f8e6ce
MD5 hash:	5c360b0c2157edb364b09a825ac1fdaa
humanhash:	cola-three-eleven-oklahoma
File name:	Win-malqla-x64.msi
Download:	download sample
Signature	DonutLoader Alert Create hunting rule
File size:	100'962'304 bytes
First seen:	2026-04-06 18:32:04 UTC
Last seen:	Never
File type:	msi
MIME type:	application/x-msi
ssdeep	3145728:Ykyfx0hwE0/zrABIMiCN75Cb0T0cxdDzncLJ:Ywhv0/3ABIMzNiWdDznwJ
Threatray	164 similar samples on MalwareBazaar
TLSH	T110283331B12A6954C11F67BFE564AF8E8431BCA1B32B629BB7783FB2457498350B1C43
TrID	80.0% (.MSI) Microsoft Windows Installer (454500/1/170) 10.7% (.MST) Windows SDK Setup Transform script (61000/1/5) 7.8% (.MSP) Windows Installer Patch (44509/10/5) 1.4% (.) Generic OLE2 / Multistream Compound (8000/1)
Magika	msi
Reporter	Ling
Tags:	donutloader msi Shellcode

CNGaoLing

This sample has been reviewed by Microsoft researchers and determined to be malware.

Shellcode

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

277

Origin country :

US

Vendor Threat Intelligence

ACCE

Gathering data

CyberFortress Malicious

Verdict:

Malicious

Score:

97.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=69d3d0e56a61012f6acf63f0

Tags:

cobalt emotet nsis

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-debug base64 CAB cmd expand expired-cert expired-cert explorer fingerprint installer lolbin lolbin overlay packed short-lived-cert smb wix

Link:

https://www.filescan.io/uploads/69d3fc41972c219c8d7a7140/reports/f52a776c-c38a-48e2-bf73-bd431fb887b7/overview

Hybrid Analysis Malicious

Verdict:

Malicious

Link:

https://www.hybrid-analysis.com/sample/cc0c1238db8928b8f82b51d3ed8ab25b5a60373c2a68eaa4c2e707adc664cd43

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

msi

First seen:

2026-04-06T12:04:00Z UTC

Last seen:

2026-04-06T17:56:00Z UTC

Hits:

~10

Detections:

Trojan.Win32.Shellcode.sb Trojan.Win32.Inject.sb Trojan.Win32.Autorun.sb Trojan.Win32.Agent.xbzdml Trojan.Win32.Agent.sb Trojan.OLE2.Agent.sb

Link:

https://opentip.kaspersky.com/cc0c1238db8928b8f82b51d3ed8ab25b5a60373c2a68eaa4c2e707adc664cd43/results?tab=lookup

Nucleon Malprob Malware

Score:

77%

Verdict:

Malware

File Type:

ARCHIVE

Link:

https://malprob.io/report/cc0c1238db8928b8f82b51d3ed8ab25b5a60373c2a68eaa4c2e707adc664cd43

CERT.PL MWDB

Gathering data

Neiki Family.DONUTLOADER

Verdict:

Malicious

Threat:

Family.DONUTLOADER

Link:

https://tip.neiki.dev/file/cc0c1238db8928b8f82b51d3ed8ab25b5a60373c2a68eaa4c2e707adc664cd43

ReversingLabs TitaniumCloud Win32.Exploit.DonutMarte

Threat name:

Win32.Exploit.DonutMarte

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-04-06 15:24:53 UTC

File Type:

Binary (Archive)

Extracted files:

724

AV detection:

6 of 24 (25.00%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=zqgbeog3reulr6blkhj63cvslnnganz4fjuovjgc44d23rtezvbq._file

Threatray donutloader

Verdict:

malicious

Label(s):

donutloader

Alert

Create hunting rule

Similar samples:

74bee981edd3316032cae86dde78b3d57dae950302f70d154b3d746495b1ab7a

DonutLoader

7c2769b905c5142f6236c48b071aef3ed4ec9895e7c132a868c725bb43a064e7

DonutLoader

9315d5eedd07e2b078b39d1dc04ae604b1468e1918f897477b3a77c728aa1f22

DonutLoader

aa0795c0c982cdd90182ffbbc1002e98ed95fb2100e800e046185af73ba93499

DonutLoader

cc0c1238db8928b8f82b51d3ed8ab25b5a60373c2a68eaa4c2e707adc664cd43

DonutLoader

d715c31183a5c242d27389d796d238045763614b983434a519b4fd4faeb15933

DonutLoader

error

DonutLoader

+ 154 additional samples on MalwareBazaar

Hatching Triage donutloader

Result

Malware family:

donutloader

Alert

Create hunting rule

Score:

  10/10

Tags:

family:donutloader discovery execution loader persistence privilege_escalation ransomware

Link:

https://tria.ge/reports/260406-w6wztaat9q/

Behaviour

Checks SCSI registry key(s)

Modifies data under HKEY_USERS

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Suspicious use of UnmapMainImage

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Uses Volume Shadow Copy WMI provider

Uses Volume Shadow Copy service COM API

Event Triggered Execution: Installer Packages

System Location Discovery: System Language Discovery

Drops file in Program Files directory

Drops file in Windows directory

Suspicious use of SetThreadContext

Enumerates connected drives

Loads dropped DLL

Command and Scripting Interpreter: PowerShell

Detects DonutLoader

DonutLoader

Donutloader family

VMRay DonutLoader

Malware family:

DonutLoader

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/cc0c1238db89/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.