MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f915aeea77112c81348e876052758daef3701da7e0d8e9e2bdfd945296578174. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

DonutLoader

Vendor detections: 13

Intelligence 13 IOCs YARA 6 File information Comments

SHA256 hash:	f915aeea77112c81348e876052758daef3701da7e0d8e9e2bdfd945296578174
SHA3-384 hash:	1c39c57cd2253e3031f36bd4339b3a6a0d9e815d5b27e3e6cb4fbea06d862cd173eafdaaff6797e617db4f551671a55f
SHA1 hash:	2560e099fe7d89aa09d303d3651ced245638a95f
MD5 hash:	9635f9a92a4532363c5be0ed32396005
humanhash:	india-happy-artist-potato
File name:	SecuriteInfo.com.Win64.Evo-gen.78854452
Download:	download sample
Signature	DonutLoader Create hunting rule
File size:	42'496 bytes
First seen:	2026-01-19 00:39:44 UTC
Last seen:	2026-01-19 01:20:17 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	1dbc59e65a2ba2ee7b1d30dc4e8df049 (1 x DonutLoader)
ssdeep	768:ekippRdTyWJcVY91FuuDwcDVAz9pRBsr7MeznVtS6Bz:ViTuWGuDD
TLSH	T175131997A5A244F9D846D2708DF2613E8B73F85105BDA70F58F09F023DB5B20FB18A86
TrID	44.4% (.EXE) Win64 Executable (generic) (10522/11/4) 21.3% (.EXE) Win16 NE executable (generic) (5038/12/1) 8.7% (.ICL) Windows Icons Library (generic) (2059/9) 8.5% (.EXE) OS/2 Executable (generic) (2029/13) 8.4% (.EXE) Generic Win/DOS Executable (2002/3)
Magika	pebin
Reporter	SecuriteInfoCom
Tags:	donutloader exe

Intelligence

File Origin

# of uploads :

# of downloads :

132

Origin country :

Vendor Threat Intelligence

No detections

Malware family:

n/a

ID:

File name:

TL1ax3z.exe

Verdict:

Malicious activity

Analysis date:

2026-01-19 00:13:14 UTC

Tags:

telegram websocket

Link:

https://app.any.run/tasks/a377a173-54f4-46ab-95e4-8a0aeca974b1

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/49284/

Detection(s):

SecuriteInfo.com.Win64.Evo-gen.78854452.UNOFFICIAL

Verdict:

Malicious

Score:

94.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=696d771af3cf908ba506371e

Tags:

stration remo hype

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

anti-debug fingerprint packed

Link:

https://www.filescan.io/uploads/696d7d85584f1963ad5a7ad8/reports/03b2ba09-5a6a-45af-ad54-ec70751f6a75/overview

Verdict:

Malicious

Labled as:

TR/W64.Evo

Link:

https://www.hybrid-analysis.com/sample/f915aeea77112c81348e876052758daef3701da7e0d8e9e2bdfd945296578174

Verdict:

Malicious

File Type:

exe x64

First seen:

2026-01-18T21:21:00Z UTC

Last seen:

2026-01-19T00:16:00Z UTC

Hits:

~100

Detections:

Trojan-PSW.Vidar.HTTP.C&C PDM:Trojan.Win32.Generic Trojan-PSW.Win32.Vidar.gjx

Link:

https://opentip.kaspersky.com/f915aeea77112c81348e876052758daef3701da7e0d8e9e2bdfd945296578174/results?tab=lookup

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/82f09a69-20ec-407a-808b-6d5e7bd1836a

Score:

99%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/f915aeea77112c81348e876052758daef3701da7e0d8e9e2bdfd945296578174

Verdict:

inconclusive

YARA:

3 match(es)

Tags:

Executable PE (Portable Executable) PE File Layout Win 64 Exe x64

Link:

https://app.malva.re/file/9635f9a92a4532363c5be0ed32396005

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f915aeea77112c81348e876052758daef3701da7e0d8e9e2bdfd945296578174/

Verdict:

Malicious

Link:

https://tip.neiki.dev/file/f915aeea77112c81348e876052758daef3701da7e0d8e9e2bdfd945296578174

Threat name:

Win64.Trojan.Mint

Status:

Malicious

First seen:

2026-01-19 00:13:31 UTC

File Type:

PE+ (Exe)

AV detection:

4 of 36 (11.11%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=7ek252txcewicneoq5qfe5mnv3zxahnh4dmotyv57wkfffsxqf2a._file

Result

Malware family:

donutloader

Score:

10/10

Tags:

family:donutloader discovery loader

Link:

https://tria.ge/reports/260119-a1jlmsbw5a/

Behaviour

Checks processor information in registry

Suspicious behavior: EnumeratesProcesses

Checks installed software on the system

Detects DonutLoader

DonutLoader

Donutloader family

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/05497e5e-12fa-4ca1-86e4-1c2e68ac4096

Unpacked files

SH256 hash:

f915aeea77112c81348e876052758daef3701da7e0d8e9e2bdfd945296578174

MD5 hash:

9635f9a92a4532363c5be0ed32396005

SHA1 hash:

2560e099fe7d89aa09d303d3651ced245638a95f

Link:

https://www.unpac.me/results/c3bddc99-caa0-41ac-bf94-49d507d34f87/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/f915aeea77112c81348e876052758daef3701da7e0d8e9e2bdfd945296578174

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Check_Debugger Create hunting rule

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__RemoteAPI Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	SEH__vectored Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)