MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 db6c2bf41a7b6ede7d44a52120348556a203963cb53d806f5a46ea715c6c1c09. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DonutLoader


Vendor detections: 13


Intelligence 13 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: db6c2bf41a7b6ede7d44a52120348556a203963cb53d806f5a46ea715c6c1c09
SHA3-384 hash: c63290bd0f80cd4da21b7884be6e01d1d00fa47b21a79ea7a31df1721ce4d9c6da7fafe9a7d9dc337d535033b1b00cdf
SHA1 hash: 56196c52cbfaf82a66ab09764705654e191abc71
MD5 hash: 74b875f066557dca9d3c99a9c2063752
humanhash: river-lion-juliet-ohio
File name:file
Download: download sample
Signature DonutLoader
Create hunting rule
File size:1'048'576 bytes
First seen:2025-11-06 16:16:30 UTC
Last seen:2025-11-06 18:18:24 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 4ee1a6456f7ed7de8beffa6389d76874 (3 x DonutLoader, 1 x Rhadamanthys)
ssdeep 3072:LgPoDgu8V8GdjRMyF6/bX414H0qd9oY4E2mMM:t0u8V8G/3FcbXbjoh7R
TLSH T14F255A5B72A534F9E1774134C8A21A42F7B2B47517719BBF07A0877A1E232E08D3EB61
TrID 48.7% (.EXE) Win64 Executable (generic) (10522/11/4)
23.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
9.3% (.EXE) OS/2 Executable (generic) (2029/13)
9.2% (.EXE) Generic Win/DOS Executable (2002/3)
9.2% (.EXE) DOS Executable Generic (2000/1)
Magika pebin
Reporter Bitsight
Tags:donutloader dropped-by-amadey exe fbf543


Avatar
Bitsight
url: http://178.16.54.200/files/7782139129/hWJ1DZo.exe

Intelligence

File Origin
# of uploads :
5
# of downloads :
121
Origin country :
US US
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
db6c2bf41a7b6ede7d44a52120348556a203963cb53d806f5a46ea715c6c1c09.bin.exe
Verdict:
No threats detected
Analysis date:
2025-11-06 16:15:29 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/9bda1f7d-baa0-4c02-887d-0b82df94b02b

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/36381/
Detection(s):
SecuriteInfo.com.Trojan.Packed2.49365.32186.31443.UNOFFICIAL
Create hunting rule

Verdict:
Clean
Score:
N/A%
Link:
https://cyber-fortress.com/docs/result/index.php?id=690cca1b5a5ed7864e239cf1
Tags:
n/a
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file
Sending a custom TCP request
Creating a window
Connecting to a non-recommended domain
Connection attempt
Sending an HTTP GET request
Сreating synchronization primitives
DNS request
Behavior that indicates a threat
Gathering data
Verdict:
Malicious
Labled as:
Midie.Generic
Link:
https://www.hybrid-analysis.com/sample/db6c2bf41a7b6ede7d44a52120348556a203963cb53d806f5a46ea715c6c1c09
Verdict:
Malicious
File Type:
exe x64
First seen:
2025-11-06T14:26:00Z UTC
Last seen:
2025-11-06T19:59:00Z UTC
Hits:
~100
Detections:
HEUR:Trojan.Multi.Donut.b Trojan.Win64.Agentb.sb VHO:Trojan.Win32.Shellcode.hgs PDM:Trojan.Win32.Generic Trojan.Win32.Shellcode.sb HEUR:Trojan.Win64.Donut.a
Link:
https://opentip.kaspersky.com/db6c2bf41a7b6ede7d44a52120348556a203963cb53d806f5a46ea715c6c1c09/results?tab=lookup
Score:
96%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/db6c2bf41a7b6ede7d44a52120348556a203963cb53d806f5a46ea715c6c1c09
Verdict:
inconclusive
YARA:
3 match(es)
Tags:
Executable PDB Path PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/74b875f066557dca9d3c99a9c2063752
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/db6c2bf41a7b6ede7d44a52120348556a203963cb53d806f5a46ea715c6c1c09/
Verdict:
Malicious
Threat:
Family.DONUTLOADER
Link:
https://tip.neiki.dev/file/db6c2bf41a7b6ede7d44a52120348556a203963cb53d806f5a46ea715c6c1c09
Threat name:
Win64.Trojan.Midie
Create hunting rule
Status:
Malicious
First seen:
2025-11-06 16:15:31 UTC
File Type:
PE+ (Exe)
Extracted files:
1
AV detection:
19 of 24 (79.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3nwcx5a2pnxn47keuuqsanefk2rahfr4wu6ya322i3vhcxdmdqeq._file
Verdict:
malicious
Label(s):
donutloader
Create hunting rule
Similar samples:
error
DonutLoader
Result
Malware family:
donutloader
Create hunting rule
Score:
  10/10
Tags:
family:donutloader defense_evasion loader spyware trojan
Link:
https://tria.ge/reports/251106-tre2mszjep/
Behaviour
Modifies system certificate store
Detects DonutLoader
DonutLoader
Donutloader family
Verdict:
Suspicious
Tags:
Stealc
YARA:
n/a
Link:
https://app.threat.zone/submission/d469a12e-d849-4c23-b4ed-e01a9c8a7d87
Unpacked files
SH256 hash:
db6c2bf41a7b6ede7d44a52120348556a203963cb53d806f5a46ea715c6c1c09
MD5 hash:
74b875f066557dca9d3c99a9c2063752
SHA1 hash:
56196c52cbfaf82a66ab09764705654e191abc71
Link:
https://www.unpac.me/results/d581f9d5-f6f6-43a9-9284-7ee6aa52b0d8/
Malware family:
DonutLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/db6c2bf41a7b/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/db6c2bf41a7b6ede7d44a52120348556a203963cb53d806f5a46ea715c6c1c09

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

DonutLoader

Executable exe db6c2bf41a7b6ede7d44a52120348556a203963cb53d806f5a46ea715c6c1c09

(this sample)

  
Dropped by
Amadey
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3698250/
Cape
Cape
https://www.capesandbox.com/analysis/36381/

Comments