General
- Target updt_nat.exe
- Size 1.2MB
- Sample260827-hemp6syvb1
- SHA256 8616185aea250013a56efd9fe7cd92c0906f856d95c55bfc9aa0a899ebd5e6bd
- MD5 cb92a9f5d300f72a788773e8787005cc
- SHA1 0ffd66ef588345d36206af64bd57210dc2f3725f
- SHA512 dec16a56b45cebb13837ccecde165a6728dd4381a84e0988511be13ae70190eac80893477d51e2d4791ce6924d3f0c3f760350990eb2ca67fd8473e871af50c1
- SSDEEP 24576:QannEBebt/2q5pg464KTwloGWeqMHwmjnKIsai:QGbEN4oTyoGWAHwKKIs
- TLSH T1B345272439FB501AB173FFA65BE8B5EADA6FB6333B0764691050034A4713A41DEC253E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
updt_nat.exe
Resource
win10v2004-20260513-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
updt_nat.exe
Resource
win11ltsc2024-20260709-en
2 signatures
150 seconds
Malware Config
Targets
-
- Target updt_nat.exe
- Size 1.2MB
- SHA256 8616185aea250013a56efd9fe7cd92c0906f856d95c55bfc9aa0a899ebd5e6bd
- MD5 cb92a9f5d300f72a788773e8787005cc
- SHA1 0ffd66ef588345d36206af64bd57210dc2f3725f
- SHA512 dec16a56b45cebb13837ccecde165a6728dd4381a84e0988511be13ae70190eac80893477d51e2d4791ce6924d3f0c3f760350990eb2ca67fd8473e871af50c1
- SSDEEP 24576:QannEBebt/2q5pg464KTwloGWeqMHwmjnKIsai:QGbEN4oTyoGWAHwKKIs
- TLSH T1B345272439FB501AB173FFA65BE8B5EADA6FB6333B0764691050034A4713A41DEC253E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Detects DonutLoader
-
Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.