donutloader | 19fe744400b13ef08de1ebfb286999479e7a3401dde7e5f9bba77e44e2dffc5a

General

Target
2026-04-18_3ef2f36b856f3538af201d2cd2b46756_cloudeye_dosia_elex_wannacry
Size 36.3MB
Sample260418-ewcpragt91
SHA256 19fe744400b13ef08de1ebfb286999479e7a3401dde7e5f9bba77e44e2dffc5a
MD5 3ef2f36b856f3538af201d2cd2b46756
SHA1 6b42d16ed55e8ff62a2f29793fd9fb8d27f2d556
SHA512 4c2cf907e24187460aecbdc454539309d1f19d441cac7ca2524178924b39c9d4900cf2eed7e271629578012e4d2b4536a1e386a3379bfec9ddf1d903c492e653
SSDEEP 786432:/1i2MUlJXplNut/5rpI5Gv3XHd9MKFq9EXknSMUmS6w3ObQvqJer:/1iHk/w/zIAvH9q9EXkSPGw3ObQvqJW
TLSH
T1D08733B30B55CC63FF949C7D88EB128D3C357627285054333A4E7A90EC5215FA6BAA72
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-04-18_3ef2f36b856f3538af201d2cd2b46756_cloudeye_dosia_elex_wannacry
- Size 36.3MB
- SHA256 19fe744400b13ef08de1ebfb286999479e7a3401dde7e5f9bba77e44e2dffc5a
- MD5 3ef2f36b856f3538af201d2cd2b46756
- SHA1 6b42d16ed55e8ff62a2f29793fd9fb8d27f2d556
- SHA512 4c2cf907e24187460aecbdc454539309d1f19d441cac7ca2524178924b39c9d4900cf2eed7e271629578012e4d2b4536a1e386a3379bfec9ddf1d903c492e653
- SSDEEP 786432:/1i2MUlJXplNut/5rpI5Gv3XHd9MKFq9EXknSMUmS6w3ObQvqJer:/1iHk/w/zIAvH9q9EXkSPGw3ObQvqJW
- TLSH
  T1D08733B30B55CC63FF949C7D88EB128D3C357627285054333A4E7A90EC5215FA6BAA72
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor defense_evasion discovery execution donutloader valleyrat_s2 installer loader persistence privilege_escalation spyware trojan
- Detects DonutLoader
  loader
- Family: DonutLoader
  DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
  loader donutloader
- Family: ValleyRat
  ValleyRat stage2 is a backdoor written in C++.
  backdoor valleyrat_s2
- Drops file in Drivers directory
- Modifies Windows Firewall
  defense_evasion
- Executes dropped EXE
- Loads dropped DLL
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Network Service Discovery
  Attempt to gather information on host's network.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2