MalwareBazaar Database
This page shows some basic information the YARA rule IDATDropper including corresponding malware samples.
Database Entry
| YARA Rule: | IDATDropper |
|---|---|
| Author: | NDA0E |
| Description: | Detects files containing embedded JavaScript; the JS executes a PowerShell command which either downloads IDATLoader in an archive, or an executable (not IDATLoader) which is loaded into memory. The modified PE will only run if it's executed as an HTML Application (.hta). |
| Firstseen: | 2024-07-31 20:18:21 UTC |
| Lastseen: | 2026-10-14 15:12:08 UTC |
| Sightings: | 178 |
Malware Samples
The table below shows all malware samples that matching this particular YARA rule (max 1000).
| Firstseen (UTC) | SHA256 hash | Tags | Signature | Reporter |
|---|