donutloader | f54a9261c0942cdd9bc22094b09eb106121137d369dc26c05a0a2651b3fc67c8

Analysis

max time kernel
150s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/09/2026, 15:19

Target
2026-09-21_085086c4be6fa1d9cad554cf78878873_icedid_luca-stealer_njrat_stealc.exe
Size 7.6MB
Sample260922-sql8wsxfpd
SHA256 f54a9261c0942cdd9bc22094b09eb106121137d369dc26c05a0a2651b3fc67c8
MD5 085086c4be6fa1d9cad554cf78878873
SHA1 3736610429e907dbfe1c0a2cfc25fc89424c890a
SHA512 3ec68ce8ab8a65b78532e2b01a9b9781ef7d99b1f5fd0df1b520b75a2fc4769792a750033c6e50933035d209cd94212b324aba4f8b5d5a40fb9d0606757d267f
SSDEEP 98304:T+ijjVMxdAGTZYbT1AxDQjV/Ax7KQAGTZ10tDgnYW:TBPVIdAGWbT1kD+V/kuQAGr+EnYW
TLSH
T1BC86E009E18B4268EF632B3888915723C1B17CC557F0D3C76ACE4A716EA7AF4267E750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader

Detects DonutLoader 1 IoCs

loader

resource	yara_rule
behavioral2/memory/4924-0-0x00007FF7383F0000-0x00007FF738B89000-memory.dmp	family_donutloader

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
behavioral2/memory/4924-0-0x00007FF7383F0000-0x00007FF738B89000-memory.dmp	UPX

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4924-0-0x00007FF7383F0000-0x00007FF738B89000-memory.dmp	upx

C:\Users\Admin\AppData\Local\Temp\2026-09-21_085086c4be6fa1d9cad554cf78878873_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-21_085086c4be6fa1d9cad554cf78878873_icedid_luca-stealer_njrat_stealc.exe"
1⤵
PID:4924

memory/4924-0-0x00007FF7383F0000-0x00007FF738B89000-memory.dmp

Download

memory/4924-1-0x00007FF7383F0000-0x00007FF738B89000-memory.dmp

Download