donutloader

General

Target
37410543dc46e2bc9a8dc80db28c8041060873f2dc9b38a26fae569abda839dd.zip
Size 4.4MB
Sample260412-ry3p6set7m
SHA256 37410543dc46e2bc9a8dc80db28c8041060873f2dc9b38a26fae569abda839dd
MD5 84559feb9bf631c2b5b1768a333e5343
SHA1 07b93fcb28cf769efc8593782f6edff6a211d001
SHA512 40699f9aec4d9c0f6b2f9641d5d663fda9db88359a8b3385411b8349e16dea744288314af7c14996b9ba6c1249915e90b362380f3da8201a70cef37aaffc852f
SSDEEP 98304:KG4i9u3PZFcF2SdCgEKWZMuGDhJ6lArdKoxPN/LcMfyckVcXIoVrNAdgN:x4iM/Md1d4FsiYdKohN/LcMo4IoVAgN
TLSH
T1972633D059B824C96A9F13C5550CB3A83C61CCBD787EB136F24BA3B49AE47D6A0F6314
MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Targets

- Target
  lineinst.msi
- Size 4.6MB
- SHA256 eaa88387f08ecfa568dc2f70e477c0aa46d6a9443ec383063d12fd7c7e715502
- MD5 f64c257e930a972f59c35e33fcfbf8d8
- SHA1 4ffbc5b826891625a9c79c04ad4042fde3cca9be
- SHA512 d5a19f56ee0bd60913859226cef6d6fd7cf83a732bd01c27df3bf31be9b436d8b3bcde4c5dc8cb3f01a898a33491d2fb60fd85261e4e79f0ab72cd335b090dc4
- SSDEEP 98304:KUEPkBbZB0z84RyYKKArMYGRFjyl0pTSsfPf/nAq/K8kFMX8mvnrAtg:KUEOv0RXvyHWECTSs3f/nAqGM8mP0g
- TLSH
  T116263341F9C08AB3C55A1632841DE368293DD8341D3A953FB38A4ABC7E715B1B3F63A5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

adware defense_evasion discovery execution quasar weedhack persistence privilege_escalation ransomware rat spyware stealer themida trojan apt41 apt backdoor donutloader plusdrop loader
- Detects DonutLoader
  loader
- Detects Plusdrop Payload
  backdoor apt apt41
- DonutLoader
  DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
  loader donutloader
- Donutloader family
  donutloader
- Minecraft Weedhack Rat - Pure Java loader.
  Minecraft Weedhack Rat - Pure Java loader.
  rat stealer
- Plusdrop family
  plusdrop
- Plusdrop, toughprogress
  Plusdrop is a backdoor used by APT41 in Toughprogress campaign that abuses Google Calendar events as its C2.
  backdoor plusdrop
- Quasar RAT
  Quasar is an open source Remote Access Tool.
  trojan spyware quasar
- Quasar family
  quasar
- Quasar payload
- Weedhack family
  weedhack
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  defense_evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Checks system information in the registry
  System information is often read in order to detect sandboxing environments.
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2