donutloader | dd225ea5febf96a018fea0a63ed3c476c0f0ee9e876e002f920249cd7a8570d2

Sharing

Copy URL Twitter E-mail

General

Target
7429cdb2-a570-38f8-1bd6-7948dd879018.eml
Size 2.4MB
Sample260522-t84fkacy4x
SHA256 dd225ea5febf96a018fea0a63ed3c476c0f0ee9e876e002f920249cd7a8570d2
MD5 05036d2ad0ebdc4943735dfc7f6c8a4b
SHA1 db322a66c884d3ec2d9741975bea230877e61edc
SHA512 74656d6e3bcd1cc99398cd29d01053315999355665bd3c3ea1706176da08f51e923ce375f2f67efe66dc883dbf52303585eb1f4e6a2320d36405f0821ae93ea7
SSDEEP 49152:YaoG6/NV5bkwzS8jQiBurdCdHOIDax6RXs2N7n:YL
TLSH
T13AB52325EDC817EB0F25C7367163B92DBB7D1FCA5A460A32426A13F422A8CF5C5E3421
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Credentials

Protocol
smtp
Host
mail.spacaex.com
Port
587
Username
[email protected]
Password
d!+L4UyRYkucBiOJ

Extracted

Family

vipkeylogger

Credentials

Protocol
smtp
Host
mail.spacaex.com
Port
587
Username
[email protected]
Password
d!+L4UyRYkucBiOJ
Email to
[email protected]

Targets

- Target
  7429cdb2-a570-38f8-1bd6-7948dd879018.eml
- Size 2.4MB
- SHA256 dd225ea5febf96a018fea0a63ed3c476c0f0ee9e876e002f920249cd7a8570d2
- MD5 05036d2ad0ebdc4943735dfc7f6c8a4b
- SHA1 db322a66c884d3ec2d9741975bea230877e61edc
- SHA512 74656d6e3bcd1cc99398cd29d01053315999355665bd3c3ea1706176da08f51e923ce375f2f67efe66dc883dbf52303585eb1f4e6a2320d36405f0821ae93ea7
- SSDEEP 49152:YaoG6/NV5bkwzS8jQiBurdCdHOIDax6RXs2N7n:YL
- TLSH
  T13AB52325EDC817EB0F25C7367163B92DBB7D1FCA5A460A32426A13F422A8CF5C5E3421
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

adware spyware collection discovery execution donutloader vipkeylogger keylogger loader stealer
- Detects DonutLoader
  loader
- Family: DonutLoader
  DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
  loader donutloader
- Family: VIPKeylogger
  VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
  stealer keylogger vipkeylogger
- Executes dropped EXE
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2
- Target
  PO-8900-QTN-20058-M089-PR-0975-7890-N0-07097-05-26.zip
- Size 1.6MB
- SHA256 2adc6c2c246c5e3820c6a7ff6c1a16a39639ec614ab5c19ff0f8c092ee563413
- MD5 7026dca4c1fd5133ae6245696434ef56
- SHA1 e5b453344d5e57a975320c0c83e2a2f59477c209
- SHA512 81e06d5c15e4c0aa49ddeb7befe86525c693da68fcd2d8c97ce8efdd3ebbce8e4f1bcf56c5672449fdc02b520ce5de8f2a409eae7443bd1ae1fb50dfc5b32f14
- SSDEEP 49152:xRxw3PRkzvrKQbe0PGuxM+v7tZBpoljmb5oufZE4w:xR2RkzvVq0PGuxM+ztZ045oufZq
- TLSH
  T11E75335408FB211FAA555E8A44EC22EBCE4834CFFB53E0DA956BC169703217973A778C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  PO-8900-QTN-20058-M089-PR-0975-7890-N0-07097-05-26.JS
- Size 3.9MB
- SHA256 4f366e255ece77f3d75a96f4ab45197369b10dcd02a362d276fc41688929a950
- MD5 f5e9784e518065b74c8f0b088c3c8878
- SHA1 e8468f0de757f3f74050bee47e9d9996e27cadb3
- SHA512 018eddff80e57e497bef87633c761d5740e1708f7742597d8f96457634673b45ad81a0073f7f543876969cf584e55e73abbc27cfecca70883a59dc398bf12eb4
- SSDEEP 98304:vzTDxZw+DrFhQ1IWX/tV1VZmxyYsJ+2GwQ+Znirdm00WdjwA81zuD0Txju33wSiW:NAX/tV1Vq0HGBunCf/cZzBTx6Jz
- TLSH
  T1E21618181B9291F27354D79C8639EE31A50F540350E4EF01317DE6383A6DC9BA3AABE7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection discovery execution donutloader vipkeylogger keylogger loader spyware stealer
- Detects DonutLoader
  loader
- Family: DonutLoader
  DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
  loader donutloader
- Family: VIPKeylogger
  VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
  stealer keylogger vipkeylogger
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral5 behavioral6
- Target
  email-html-2.txt
- Size 134KB
- SHA256 a9cd0da107c066d55b1a9e7778e71d56f9662fe6254dc90618b60b4c156732b4
- MD5 935ed57a85a7b6982bb2e7f99fd2af14
- SHA1 7b2826f366d81ed0f3094a23a59f145de25f2258
- SHA512 3a2c08ed562259a7d832b7f2a83baaba05eb013c4e0efbf2ed520697067fcf500c8199412573144bdbc0d11c52a7b135a63b2e1b3026fa9b608f4b972ad32904
- SSDEEP 3072:UK7CPUHrET1lbQyK3BYE3MjSnBjqLcuVtBw5Wep3:UK7sULi0hYEcjS4LcuT5eZ
- TLSH
  T123D3AD13F7E02E11CA9F49206523237D3F3942CA9B764E7858DB3BBE178CCE28592255
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Loads dropped DLL
behavioral7 behavioral8
- Target
  email-plain-1.txt
- Size 1KB
- SHA256 635708f03253ce05ffef027b89e0c1be9f643c1d5e6a2b95fdc8cbbc6e555be5
- MD5 3782906eee64881876481abef58bb63d
- SHA1 3185a23bbac4020d28b1b0734146eb7d145f29ce
- SHA512 1723d4b76a44fb6b26015e234c56a8d66ce9c597fb711ce546ddb99d53cec647f887750f7b82f718a5e652ea2377468188ccc2a99302dbca91f1c1d9adcef54a
- TLSH
  T1D931429E61EB121E94FB36B53A6B759CF1B8401DF797502078BD84882B92E82272105D
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral10 behavioral9