MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e36df1a98574c37e463f13aee1ade962afcadc11ed4756c9c4412e7a71f67fc3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry



DonutLoader


Vendor detections: 13


Intelligence 13 IOCs YARA 3 File information Comments

SHA256 hash: e36df1a98574c37e463f13aee1ade962afcadc11ed4756c9c4412e7a71f67fc3
SHA3-384 hash: 95724497ab48f9b2dc3a3e7ffd9f61e382b962837b0320ac60aa65dc1ea5b650e574765b0ac66defe1ae566460facee6
SHA1 hash: 6b225061f948db0f4dc142d07781eaae12211351
MD5 hash: a3c9eb98125f8c161ce2ba8a5648ab14
humanhash: nevada-alaska-nitrogen-vegan
File name:file
Download: download sample
Signature DonutLoader
File size:135'168 bytes
First seen:2026-02-12 12:02:35 UTC
Last seen:2026-02-12 14:00:19 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 0599c6cd8dbde331f6fd2d14de683e7f (1 x DonutLoader)
ssdeep 1536:GIaqakumflUyeGpWOg1hVO2HTHgS6lRc21tVhJEassW6hd39dlzZhbRpYkyw7:Dar4Zv2VOaAdlRdb7JPh3BZhbRpZ7
TLSH T163D36C4773A631F8E1778139C4A11A46F776B87557609FEF03A04A6A1F236E08D3BB21
TrID 48.7% (.EXE) Win64 Executable (generic) (10522/11/4)
23.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
9.3% (.EXE) OS/2 Executable (generic) (2029/13)
9.2% (.EXE) Generic Win/DOS Executable (2002/3)
9.2% (.EXE) DOS Executable Generic (2000/1)
Magika pebin
Reporter Bitsight
Tags:138f52 donutloader dropped-by-amadey exe


Avatar
Bitsight
url: http://85.137.252.28/vivo.exe

Intelligence


File Origin
# of uploads :
2
# of downloads :
127
Origin country :
US US
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
file
Verdict:
Malicious activity
Analysis date:
2026-02-12 12:02:57 UTC
Tags:
n/a

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Verdict:
Malicious
Score:
97.4%
Tags:
shellcode dropper trojan zbot
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending an HTTP GET request to an infection source
DNS request
Сreating synchronization primitives
Connection attempt
Sending a custom TCP request
Sending an HTTP GET request
Connection attempt to an infection source
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
microsoft_visual_cc
Verdict:
Malicious
Labled as:
Win64/ShellcodeRunner.DM trojan
Result
Gathering data
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PDB Path PE (Portable Executable) PE File Layout Win 64 Exe x64
Verdict:
malicious
Label(s):
donutloader
Similar samples:
Result
Malware family:
donutloader
Score:
  10/10
Tags:
family:donutloader loader
Behaviour
Detects DonutLoader
DonutLoader
Donutloader family
Unpacked files
SH256 hash:
e36df1a98574c37e463f13aee1ade962afcadc11ed4756c9c4412e7a71f67fc3
MD5 hash:
a3c9eb98125f8c161ce2ba8a5648ab14
SHA1 hash:
6b225061f948db0f4dc142d07781eaae12211351
Malware family:
DonutLoader
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures


MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:cobalt_strike_tmp01925d3f
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:DebuggerCheck__API
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:golang_bin_JCorn_CSC846
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Web download

DonutLoader

Executable exe e36df1a98574c37e463f13aee1ade962afcadc11ed4756c9c4412e7a71f67fc3

(this sample)

  
Dropped by
Amadey
  
Delivery method
Distributed via web download

Comments