MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 eefbb8cfb3107d81df0cc28b5af62df42907386b771e818efc2b8d9851b24b84. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DonutLoader


Vendor detections: 10


Intelligence 10 IOCs YARA 14 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: eefbb8cfb3107d81df0cc28b5af62df42907386b771e818efc2b8d9851b24b84
SHA3-384 hash: d4d9dfb453a4ba996fcf05f7f2e5b5f6a6e3c03b29df64d2b10fff6cee6b54adc3c60e6ff744076c08df9a9f974c2dc3
SHA1 hash: 22f29af13509901c1d1dff47aea1dc969fec4f6d
MD5 hash: c1c257c6f8b6e6ad8ef618c1e4593260
humanhash: eleven-violet-bulldog-video
File name:SecuriteInfo.com.Trojan.Siggen32.10693.18436.32738
Download: download sample
Signature DonutLoader
Create hunting rule
File size:297'472 bytes
First seen:2025-12-08 17:46:39 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 53e19d5243b4f25d48df742c8d94ac9c (11 x DonutLoader)
ssdeep 3072:9fRbXxsn6slR57cZ6EhE4IQNv8kAeI2yEe28Plq9njUIg9P8W/mrakO+OlCCxFUz:9fRbGY6EDNNAuHe28Pl2ncxlJaR2O
Threatray 123 similar samples on MalwareBazaar
TLSH T1EB548D15BAA810FEE977C17CC9428906EB72BC464761E7CF13904AA62F277D09D3EB11
TrID 44.4% (.EXE) Win64 Executable (generic) (10522/11/4)
21.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
8.7% (.ICL) Windows Icons Library (generic) (2059/9)
8.5% (.EXE) OS/2 Executable (generic) (2029/13)
8.4% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
Reporter SecuriteInfoCom
Tags:donutloader exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
FR FR
Vendor Threat Intelligence
No detections
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/43905/
Gathering data
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
fingerprint microsoft_visual_cc packed
Link:
https://www.filescan.io/uploads/69370f1fbc15eab491f75b12/reports/034030d0-fc27-493b-a601-ae1d68849479/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/eefbb8cfb3107d81df0cc28b5af62df42907386b771e818efc2b8d9851b24b84
Result
Gathering data
Verdict:
Malicious
File Type:
exe x64
First seen:
2025-12-05T12:30:00Z UTC
Last seen:
2025-12-08T14:36:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/eefbb8cfb3107d81df0cc28b5af62df42907386b771e818efc2b8d9851b24b84/results?tab=lookup
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/eefbb8cfb3107d81df0cc28b5af62df42907386b771e818efc2b8d9851b24b84
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
Executable PDB Path PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/c1c257c6f8b6e6ad8ef618c1e4593260
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/eefbb8cfb3107d81df0cc28b5af62df42907386b771e818efc2b8d9851b24b84/
Threat name:
Win64.Trojan.Mikey
Create hunting rule
Status:
Malicious
First seen:
2025-12-05 15:26:36 UTC
File Type:
PE+ (Exe)
AV detection:
25 of 36 (69.44%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=5353rt5tcb6ydxymykfvv5rn6quqoodlo4piddx4fogzqunsjoca._file
Verdict:
malicious
Label(s):
stealc
Create hunting rule
shellcode_loader_007
Create hunting rule
Similar samples:
469e0027cb53e2ba2bfe66d4aac3ea456fe4e91efbd11b631db252a9a1b02a8e
DonutLoader
487b6acddac1739cc3a60cf049c4c33fc6b90df631f71b414775e3c83661afec
DonutLoader
53a4ec3d8e00bb60c891bf45069a2ea5a987382410b76613c7fc7c9407693daf
DonutLoader
7a1e4f70eee2e623e59867467b1e9174faec5731d6e598a921f838d97f31677e
DonutLoader
857e377f50ad012a0ba740ad9b13e9af2a0c48c49a6e988b7279a69b6524cd69
DonutLoader
ce49befb88317c929087b48a7a965f24b56712d8ca19ffffb620fe799806f2cf
DonutLoader
+ 113 additional samples on MalwareBazaar
Result
Malware family:
stealc
Create hunting rule
Score:
  10/10
Tags:
family:stealc botnet:8f5c15tl14531e71q3 defense_evasion execution stealer
Link:
https://tria.ge/reports/251208-wcyasagy3c/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Hide Artifacts: Hidden Window
Checks computer location settings
Executes dropped EXE
Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
Command and Scripting Interpreter: PowerShell
Downloads MZ/PE file
Enumerates VirtualBox registry keys
Stealc
Stealc family
Malware Config
C2 Extraction:
https://content-distribution-v2.pro
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/4036bcf6-8ac5-4e03-ac33-01591b915b5f
Unpacked files
SH256 hash:
eefbb8cfb3107d81df0cc28b5af62df42907386b771e818efc2b8d9851b24b84
MD5 hash:
c1c257c6f8b6e6ad8ef618c1e4593260
SHA1 hash:
22f29af13509901c1d1dff47aea1dc969fec4f6d
Link:
https://www.unpac.me/results/fe6af1b7-13fc-42e3-8f3a-11c5d71097ad/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:Disable_Defender
Create hunting rule
Author:iam-py-test
Description:Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:Heuristics_ChromeABE
Create hunting rule
Author:Still
Description:attempts to match instructions related to Chrome App-bound Encryption elevation service; possibly spotted amongst infostealers
Rule name:malware_shellcode_hash
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect shellcode api hash value
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:StealcV2
Create hunting rule
Author:Still
Description:attempts to match the instructions found in StealcV2
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

DonutLoader

Executable exe eefbb8cfb3107d81df0cc28b5af62df42907386b771e818efc2b8d9851b24b84

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3729344/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/43905/

Comments