MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dfd7432d2e19067b096ccbb0aaab030bfb4dbc78f5cf6b6b5971e5f6871f7204. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	dfd7432d2e19067b096ccbb0aaab030bfb4dbc78f5cf6b6b5971e5f6871f7204
SHA3-384 hash:	4f097875adb5bde8bca8a37cbf27171eab980b41338769b1c0a1f6262027c36a8d8df39a5874fb49d6d7e41f1a51a1b7
SHA1 hash:	8090b1762283891671a2a549f4f54edb23e53a8f
MD5 hash:	fa8fdc6064f86f29fe4f8e4c1352f4ed
humanhash:	connecticut-blossom-fix-stream
File name:	decoded_injected_shellcode.rar
Download:	download sample
Signature	QuasarRAT Alert Create hunting rule
File size:	1'295'106 bytes
First seen:	2026-02-09 15:32:19 UTC
Last seen:	Never
File type:	rar
MIME type:	application/x-rar
ssdeep	24576:sXWFw9XDEp4atwWQnkylLjp887E3PEta5qpkS1Ige9D+ri:sX2qTEpwyyhTwfEKjS1Te9D+e
TLSH	T1F05533A07DFC6429FDD8194FE6BD234F97840E810F61FAAA899561F497072B32981F34
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Magika	rar
Reporter	ShadowOpCode
Tags:	193-161-193-99 QuasarRAT rar

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

66

Origin country :

IT

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

Relevant files 1

File name:	decoded_injected_shellcode.bin
File size:	1'302'053 bytes
SHA256 hash:	76114812ca9a8d15ce6e60df57036feee4dd8311ea9d012669206f341d58ba75
MD5 hash:	09d67b7119deab290876383eeb497200
MIME type:	application/octet-stream
Signature	QuasarRAT

Vendor Threat Intelligence

ACCE Rar_Archive

Details

Link:

https://research.acce.ciphertechsolutions.com/results/b19ae795-07bd-4813-a7b2-2ff554f79c73/

ClamAV Detected

Detection(s):

SecuriteInfo.com.Trojan.Packed2.50724.29526.8758.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

70%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6989fe474c8b031249cdba6f

Tags:

malware

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

donut

Link:

https://www.filescan.io/uploads/6989fe40930564ff3c94841d/reports/28b5602a-c52a-4edd-87e3-75bc9bd42176/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/dfd7432d2e19067b096ccbb0aaab030bfb4dbc78f5cf6b6b5971e5f6871f7204

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

rar

First seen:

2026-02-09T15:12:00Z UTC

Last seen:

2026-02-09T15:23:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/dfd7432d2e19067b096ccbb0aaab030bfb4dbc78f5cf6b6b5971e5f6871f7204/results?tab=lookup

Malva.RE inconclusive

Verdict:

inconclusive

YARA:

1 match(es)

Tags:

Rar Archive

Link:

https://app.malva.re/file/fa8fdc6064f86f29fe4f8e4c1352f4ed

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/dfd7432d2e19067b096ccbb0aaab030bfb4dbc78f5cf6b6b5971e5f6871f7204/

ReversingLabs TitaniumCloud Win64.Trojan.Donut

Threat name:

Win64.Trojan.Donut

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-02-09 15:33:29 UTC

File Type:

Binary (Archive)

Extracted files:

1

AV detection:

9 of 24 (37.50%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=37lugljodedhwclmzoykvkydbp5u3pdy6xhww22zohs7nby7oica._file

Hatching Triage donutloader

Result

Malware family:

donutloader

Alert

Create hunting rule

Score:

  10/10

Tags:

family:donutloader loader

Link:

https://tria.ge/reports/260209-t4w6pab14c/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/dfd7432d2e19067b096ccbb0aaab030bfb4dbc78f5cf6b6b5971e5f6871f7204