General
- Target Anzivota_Application_Form.zip
- Size 2.0MB
- Sample260625-wv4waaev4m
- SHA256 0a8cb037da1b099b950b8d4dfc72bbb1fd8d312f4c7f956a892ce5d0dd157443
Score
10/10
Malware Config
Targets
-
- Target Anzivota_Application_Form.exe
- Size 4.5MB
- SHA256 bf5f9ec939cf7c7a5ddab98057660d7335dd5a2d1a3961579c3e507da60e9792
Score10/10-
Detects DonutLoader
-
Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
-
Drops startup file
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
- Target WUAssistant.exe
- Size 19KB
- SHA256 4744fdaaad39ea55bde04c4132732a37282ff17dd305b191ce2a7f4ab0aa83c9
Score10/10-
Detects DonutLoader
-
Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
- Target version.dll
- Size 12KB
- SHA256 cb4acd85db305be8158a7e5fb8cf27d2397cd3644f27be3d9f4f506058cc0dfc
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target version_orig.dll
- Size 49KB
- SHA256 554de4c9c64cba19bb3437ede1d3688f3d020285a182161658779b8b34614306
Score1/10