donutloader | f2228128e497575884a83e098a18ad38920d5d0ab5d8f71003f94b50b03f0c6d

General

Target
Delivery Note.bat
Size 421KB
Sample260604-la2kbacy3p
SHA256 f2228128e497575884a83e098a18ad38920d5d0ab5d8f71003f94b50b03f0c6d
MD5 f8f2f342fe17a595627cc06137bcab41
SHA1 37e8bea430961a4fe804b627752193108f80f8e9
SHA512 c550f19a96e1dab10c6f816f286447cec85b756cca6da4f1e731d0f40417edefdcee723c233e4b69b7e94f162a0ed58f8a96ec788924f033570d8a15bc03c9bd
SSDEEP 12288:x0qdL/NP1VygGtz7arq//2cCvNgSov3VfBYA/Azqmrwe6ddSHT:xVdL9fygOPxCvGvprA2mrkzSz
TLSH
T1819422613E86CD2714F543ADE22EB55F6B0CC6F97794E0DAB09EF1D326C8B468E46081
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Delivery Note.bat
- Size 421KB
- SHA256 f2228128e497575884a83e098a18ad38920d5d0ab5d8f71003f94b50b03f0c6d
- MD5 f8f2f342fe17a595627cc06137bcab41
- SHA1 37e8bea430961a4fe804b627752193108f80f8e9
- SHA512 c550f19a96e1dab10c6f816f286447cec85b756cca6da4f1e731d0f40417edefdcee723c233e4b69b7e94f162a0ed58f8a96ec788924f033570d8a15bc03c9bd
- SSDEEP 12288:x0qdL/NP1VygGtz7arq//2cCvNgSov3VfBYA/Azqmrwe6ddSHT:xVdL9fygOPxCvGvprA2mrkzSz
- TLSH
  T1819422613E86CD2714F543ADE22EB55F6B0CC6F97794E0DAB09EF1D326C8B468E46081
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery execution donutloader formbook loader rat spyware stealer trojan
- Detects DonutLoader
  loader
- Family: DonutLoader
  DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
  loader donutloader
- Family: Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Formbook payload
  rat
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Detects DonutLoader

Family: DonutLoader

Family: Formbook

Formbook payload

Command and Scripting Interpreter: PowerShell

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2