General
- Target SHELL.exe
- Size 48.6MB
- Sample260623-xp2dmsfx2x
- SHA256 7de2483d97a87d347b12c0efb2b9f8c7c736f55bf40b6372aaf9d8851f6f27db
- MD5 f169933dd69d194d8f5addfcf9388542
- SHA1 61cd57747adc030bae87ed2f6d5bebfd80fdafe1
- SHA512 da2024f891a06c0dfaf86fd952717195d4a23867f3ccee7bf04234181fc9fb662c743eb3abc980d86d64021cb69a26aca659c847ffe93443233bba5c5f4a9dac
- SSDEEP 12288:Iquze1wkjOIIKjgj3ukoSwJ27mAHpvxaFVakXgPpe1dj/+44nMWFxCLRaSfJ5D5i:C
- TLSH T1FBB7FCDEA71D56E90EDB37A8EB464963BE84A9350A74824FF7AF851FF00F81500F0916
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
SHELL.exe
Resource
win10v2004-20260513-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
SHELL.exe
Resource
win11ltsc2024-20260618-en
5 signatures
150 seconds
Malware Config
Targets
-
- Target SHELL.exe
- Size 48.6MB
- SHA256 7de2483d97a87d347b12c0efb2b9f8c7c736f55bf40b6372aaf9d8851f6f27db
- MD5 f169933dd69d194d8f5addfcf9388542
- SHA1 61cd57747adc030bae87ed2f6d5bebfd80fdafe1
- SHA512 da2024f891a06c0dfaf86fd952717195d4a23867f3ccee7bf04234181fc9fb662c743eb3abc980d86d64021cb69a26aca659c847ffe93443233bba5c5f4a9dac
- SSDEEP 12288:Iquze1wkjOIIKjgj3ukoSwJ27mAHpvxaFVakXgPpe1dj/+44nMWFxCLRaSfJ5D5i:C
- TLSH T1FBB7FCDEA71D56E90EDB37A8EB464963BE84A9350A74824FF7AF851FF00F81500F0916
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Detects DonutLoader
-
Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.