donutloader | 171bfe80f568b5df69d1775f5c008356f775b5f5d0c53140ea7db0233a87403c

General

Target
Order_Details.zip
Size 157.9MB
Sample260601-ywph4aev9x
SHA256 171bfe80f568b5df69d1775f5c008356f775b5f5d0c53140ea7db0233a87403c
MD5 015f67da29e537ce1c5121bb63340e41
SHA1 e8758e065906e58aed6abd7c75210f850891f2b4
SHA512 eac9e3e1fdbaed2e99104b10f89c4cd6322cd0292dac04a566f76d86444ca6d090cc6a9b23d27b399079cbf6fb986d0f0b77cbb4c359fa3ae206a4ee151c45dc
SSDEEP 3145728:FKJbQAgS2dzp2gXgd8FLILNk6Pb3iiDclj7wnhtE0cwMyiDgxoZd:4lZ2dzogdLqkqzi3GtE0jMyi0CZd
TLSH
T1DB883360EFB4CB47DDA775BF443DF8A1E89EA19034B1E4E9DE68825834CC9120D1C66B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Order_Details.zip
- Size 157.9MB
- SHA256 171bfe80f568b5df69d1775f5c008356f775b5f5d0c53140ea7db0233a87403c
- MD5 015f67da29e537ce1c5121bb63340e41
- SHA1 e8758e065906e58aed6abd7c75210f850891f2b4
- SHA512 eac9e3e1fdbaed2e99104b10f89c4cd6322cd0292dac04a566f76d86444ca6d090cc6a9b23d27b399079cbf6fb986d0f0b77cbb4c359fa3ae206a4ee151c45dc
- SSDEEP 3145728:FKJbQAgS2dzp2gXgd8FLILNk6Pb3iiDclj7wnhtE0cwMyiDgxoZd:4lZ2dzogdLqkqzi3GtE0jMyi0CZd
- TLSH
  T1DB883360EFB4CB47DDA775BF443DF8A1E89EA19034B1E4E9DE68825834CC9120D1C66B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery donutloader loader spyware stealer
- Detects DonutLoader
  loader
- Family: DonutLoader
  DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
  loader donutloader
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral1 behavioral2
- Target
  lib2to3/Grammar.txt
- Size 8KB
- SHA256 6688247a4adb2b38f18ef1c293482a394fa7e041110131f5f515a966c41e0490
- MD5 0a88c3b5566aed4547d21c95e38a8a85
- SHA1 5e558f0def7eb2976e4cf296a308b373bf567234
- SHA512 9a655fa0f8ba2f14c0e4568e55454b2ae79d05c2c7107b6f85440a13b57d842fc05e981f36069d3409ffba9bd10562f7171e80beac8816b65d3d77793bdedef1
- SSDEEP 192:UXA+piq3vVDRGSdkFobat4/JSjjpZMhmb8b72Q:UwqVDZdQoL/JSjjp9If2Q
- TLSH
  T12C02B81CB6D7068606F11477421DF7FB869DD1CE70154170FBCCA2FC9FEA8551226A2A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

ransomware
behavioral3 behavioral4
- Target
  lib2to3/Grammar3.10.11.final.0.pickle
- Size 14KB
- SHA256 97c8ed74d091fcfd23498029bb819c29d096c3dcb1326edee5dfb0591ade2e4b
- MD5 6d521bed2bfed7a06dd81bf2125a027a
- SHA1 47dd3b214dff823298d3c9a4ffe32ef59824f496
- SHA512 b04114607da0cb021e2350216b88b829c0ce8832c972da8e97f0d530f591d900d023d2945d95d0c3d70f29e4161f26d496da315b5ba49bf75855f78a22c7b7cd
- SSDEEP 192:BRozbXGPRv2sK5EHWoX+pnWWATwdqMqE/:urOK50WpE/McMF
- TLSH
  T1D8622D81B7C6B30E2BBD0D16D617931812BEFCE13B627E526B539F02671D64822E074E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

ransomware
behavioral5 behavioral6