formela.bin
- SHA256 d93629615b5b5687b0db04375b9bef9163aa08c848c9c69f8d7b3225dc58847e
-
Detects DonutLoader
General
- Target formela.bin
- Size 267KB
- Sample261003-pl8dsazwez
- SHA256 d93629615b5b5687b0db04375b9bef9163aa08c848c9c69f8d7b3225dc58847e
- MD5 aee07815314182adbc8a5908d146e902
- SHA1 d06860c0f3d40a9a2c1519cf3785c282c39ee676
- SHA512 80b77a3097e5946d6bf83a6861cc89748f1aaa2977665cc52935b95653e5f0399172b3d91a26845e1c0b60fecd2830a7f394ebff8c60a2851bf1a8ee19b6e434
- SSDEEP 6144:LrKG9lWEkI5/eldXPK5L9FeGmHY+trBoz4WfqGcvWOGb3Mqm6ysB:LvPWEdVQmLndiVqxfqTvRGbDm6JB
- TLSH T1F04412B0DFB206E8F7A3D06B9861F61FFEF5385B995039E77782454222324316B4C259
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Detects DonutLoader 1 IoCs
resource yara_rule sample family_donutloader
File Explorer
-
formela.bin267KB