Overview

overview

10

Static

static

3

START 3.exe

windows10-2004-x64

10

START 3.exe

windows11-21h2-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    START 3.exe
  • Size 156KB
  • Sample250907-2hecraymv7
  • SHA256 252918aaa98f25a1cc128e8eebb27905ded606d4eb04285abbf5344ff51947ba
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
donutloaderrhadamanthysdiscoveryloaderstealer

Malware Config

Targets

    • Target
      START 3.exe
    • Size 156KB
    • SHA256 252918aaa98f25a1cc128e8eebb27905ded606d4eb04285abbf5344ff51947ba
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    discoverydonutloaderrhadamanthysloaderstealer

    • Detects DonutLoader

      loader

    • Detects Rhadamanthys Payload

    • DonutLoader

      DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

      loaderdonutloader

    • Donutloader family

      donutloader

    • Rhadamanthys

      Rhadamanthys is an info stealer written in C++ first seen in August 2022.

      stealerrhadamanthys

    • Rhadamanthys family

      rhadamanthys

    • Downloads MZ/PE file

    • Executes dropped EXE

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks