Extracted

• • Target
    2026-07-07_bec8664bdc3a0f2e67fbc78815d7736e_hive
  • Size 1.6MB
  • SHA256 1de4ffc976f3a93f3c74291753a45877fd59c13e55c52650e0e2ce5ca30e1b84
  • MD5 bec8664bdc3a0f2e67fbc78815d7736e
  • SHA1 1e8cf55cb0127a0ea7aec60d729ff4467907a91c
  • SHA512 93d5db29c1b0198eaf52c18e665d6e48fc3584ec6af4b852e1ed855e8c2db09f828a795686249021401930f9b67629bfc05da67914edb223f285ddf9712051c6
  • SSDEEP 49152:OM+Ko33+Bi/X9NfRkFA79BwzISJpGw0r:Z+KdBsXjqi74ISw
  • TLSH
    T1977533C5994A9F1ADEC6B5BF2DBC9DB83910B08146544C2F33813D659B8CF079C2EA4B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  donutloaderneptuneratloadertrojanupx

  • Detects DonutLoader

    loader

  • Detects NeptuneRAT stealer

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: NeptuneRAT, MasonRAT

    NeptuneRAT aka MasonRAT is a trojan written in C#.

    trojanneptunerat

  • Detects Windows executables referencing non-Windows User-Agents

  • UPX dump on OEP (original entry point)

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2