Overview

overview

10

Static

static

3

926ab7d10d...ld.exe

windows10-2004-x64

10

926ab7d10d...ld.exe

windows11-21h2-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    926ab7d10da645f08b9d109b5bab77c8_bound_build.exe
  • Size 11.8MB
  • Sample250909-tpem4axyew
  • SHA256 30235049839cd3ddfb7e50e8a58f3d0c2a5dffaa632c671a97de12ed1dfa6a06
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
donutloaderrhadamanthysdiscoveryloaderstealer

Malware Config

Targets

    • Target
      926ab7d10da645f08b9d109b5bab77c8_bound_build.exe
    • Size 11.8MB
    • SHA256 30235049839cd3ddfb7e50e8a58f3d0c2a5dffaa632c671a97de12ed1dfa6a06
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    discoverydonutloaderrhadamanthysloaderstealer

    • Detects DonutLoader

      loader

    • Detects Rhadamanthys Payload

    • DonutLoader

      DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

      loaderdonutloader

    • Donutloader family

      donutloader

    • Rhadamanthys

      Rhadamanthys is an info stealer written in C++ first seen in August 2022.

      stealerrhadamanthys

    • Rhadamanthys family

      rhadamanthys

    • Downloads MZ/PE file

    • Executes dropped EXE

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks