General
- Target cr2.exe
- Size 472KB
- Sample260910-spegnadl6v
- SHA256 b3c25f3298b968e2b598aea991ddd3bc9420a6c414f54b0b79d8c05bd2c7a46c
- MD5 dd393eefda2b72268b1733f60c21dd16
- SHA1 fff2243762c43961ecd0546880dbf4a76b147d97
- SHA512 cd192813124f8c7dda4eec98a80268ff06266ad0422f72c4a9d5d53b5534f3e68977fc058d6ec16744f560d776654ad1f3628c340b9db243176ff4fc6e48a1bd
- SSDEEP 12288:mrBmukBSHIaAO8wLB28AZmT510/nIytn:mrBEGItO1t28Aa10vp
- TLSH T111A423152B5E85BDC449A731F05B46B5A9F2EE002850DF8FDA89358A2F6E701031AFF7
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cr2.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
cr2.exe
Resource
win11ltsc2024-20260709-en
4 signatures
150 seconds
Malware Config
Targets
-
- Target cr2.exe
- Size 472KB
- SHA256 b3c25f3298b968e2b598aea991ddd3bc9420a6c414f54b0b79d8c05bd2c7a46c
- MD5 dd393eefda2b72268b1733f60c21dd16
- SHA1 fff2243762c43961ecd0546880dbf4a76b147d97
- SHA512 cd192813124f8c7dda4eec98a80268ff06266ad0422f72c4a9d5d53b5534f3e68977fc058d6ec16744f560d776654ad1f3628c340b9db243176ff4fc6e48a1bd
- SSDEEP 12288:mrBmukBSHIaAO8wLB28AZmT510/nIytn:mrBEGItO1t28Aa10vp
- TLSH T111A423152B5E85BDC449A731F05B46B5A9F2EE002850DF8FDA89358A2F6E701031AFF7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects DonutLoader
-
Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
-
Formbook payload
-
ConfuserEx .NET packer
Detects ConfuserEx .NET packer.