donutloader | 3b11377cf912c64c60480a1aabc2c15733f715fe5751ba0dc3271493fb58abf7

General

Target
25042026_1458_24042026_RFQ-SPD-5520-GBR-107-2026.zip
Size 102KB
Sample260425-scelwsdx4m
SHA256 3b11377cf912c64c60480a1aabc2c15733f715fe5751ba0dc3271493fb58abf7
MD5 c958255898ec0dee8b28418afb9bd44b
SHA1 45ddfd208fb23ba4a6c48d976d383ff2662e9d4e
SHA512 c5ca7ffc38ae54df661566628a60a1441162653eca9236cc7b5310d02085452150367f183ccda559824535bd9837dc5edceb10e13af4c5dc60634c0eee05cf2a
SSDEEP 1536:Ga9ica3KyyUbV/nx7KGVM7v4wTydMUWY3/iWheQe64Bdgf4VFO0dN7qUVDBIBB1B:GVP/pfDujUdiS/ReDdgf4ZNW+AB1ky
TLSH
T1C6A3127F675B48C1EA28D09E0178C9109D2AAE21303B6FFF29ECDE9820323F115E9214
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Credentials

Protocol
smtp
Host
mail.taikei-rmc-co.biz
Port
587
Username
[email protected]
Password
dy8tm;jRtJO[:bG:

Extracted

Family

masslogger

Attributes

exfiltration_mode
#SMTPEnabled
expire_time_date
2025-12-17
host_password
dy8tm;jRtJO[:bG:
host_port
587
host_receiver
[email protected]
host_sender
[email protected]
host_server
mail.taikei-rmc-co.biz
ssl_slate
True

Targets

- Target
  RFQ-SPD-5520-GBR-107-2026.bat
- Size 145KB
- SHA256 2168a3295dc3efc1cd46ba5c7052a95645bd92e09002b69ab4ec5277ef678c78
- MD5 e3ea9010003f5e7d400a39a573b25ff4
- SHA1 28bbf1e060b6d777a2a5f98a4d2707907f7057ae
- SHA512 94284463d3b040da7823504bcd4923dd6d348a5f30115b2e5516f5951ce2127b2ddeed823645f5170cf90ccf2eb0d5e4736c99a7c842025e207d233ea43ee035
- SSDEEP 3072:HbVFMumWPvnMJf61XirvT0E2KlqYBSLdh2zdPl26luPe7hL:HbD+W8p6E+uqoSLP258euPeh
- TLSH
  T1BFE3F126E4882E6DCFFC6E1484BF061E23E0C6DF551D594DF7333E9A6FAA50842192C9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection defense_evasion execution donutloader masslogger loader persistence privilege_escalation spyware stealer
- Detects DonutLoader
  loader
- Family: DonutLoader
  DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
  loader donutloader
- Family: MassLogger
  Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
  stealer spyware masslogger
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2