donutloader | 772d8cfb62cc8c45f449a459742346ef66c5093dda7abba38252f40b0e58531a

Sharing

Copy URL Twitter E-mail

General

Target
CREATIVE EAX.exe
Size 9.7MB
Sample260628-cfajcaey5y
SHA256 772d8cfb62cc8c45f449a459742346ef66c5093dda7abba38252f40b0e58531a
MD5 c67cd3edfd37061bee66a6bb37ac78e8
SHA1 11533588d2699556c2087bfb35d0aee0a05e5fb8
SHA512 7ac5ae4a01015b8553f2628b9ef14c15fa51acfee01b2ba5da1b818cf8ea09f2ba3909d2ce50e3400bdb22a3749964da10653427262f5b4009fbe3c1eaa4f54e
SSDEEP 768:o75aBeVQHKZUbutoi7MdGvwBa1PetdDCRgHG0xa3Y1+LMpBkjWNACmi58u/4p6r6:nDbUGdm9
TLSH
T1DCA68D0655EE260F68F76FB2DFE4B9FAC287F1E4586938FE049022864711D64DA33076
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

xbinder

Mutex

WWahb5jULl1vhnOxH

Attributes

primary_drop_directory
%Temp%
primary_execute
true
primary_hidden_file
false
primary_resource_name
CREATIVE EAX.exe
secondary_drop_directory
%Temp%
secondary_execute
true
secondary_hidden_file
false
secondary_resource_name
MasonClient.exe

Targets

- Target
  CREATIVE EAX.exe
- Size 9.7MB
- SHA256 772d8cfb62cc8c45f449a459742346ef66c5093dda7abba38252f40b0e58531a
- MD5 c67cd3edfd37061bee66a6bb37ac78e8
- SHA1 11533588d2699556c2087bfb35d0aee0a05e5fb8
- SHA512 7ac5ae4a01015b8553f2628b9ef14c15fa51acfee01b2ba5da1b818cf8ea09f2ba3909d2ce50e3400bdb22a3749964da10653427262f5b4009fbe3c1eaa4f54e
- SSDEEP 768:o75aBeVQHKZUbutoi7MdGvwBa1PetdDCRgHG0xa3Y1+LMpBkjWNACmi58u/4p6r6:nDbUGdm9
- TLSH
  T1DCA68D0655EE260F68F76FB2DFE4B9FAC287F1E4586938FE049022864711D64DA33076
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution donutloader xbinder loader persistence
- Detects DonutLoader
  loader
- Family: DonutLoader
  DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
  loader donutloader
- Family: XBinder
  XBinder is a crypter and loader delivering a wide variety of malware, written in C#.
  loader xbinder
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Creates new service(s)
  persistence execution
- Executes dropped EXE
- Stops running service(s)
  defense_evasion execution
- Drops file in System32 directory
behavioral1 behavioral10 behavioral11 behavioral12 behavioral13 behavioral14 behavioral15 behavioral16 behavioral17 behavioral18 behavioral19 behavioral2 behavioral20 behavioral3 behavioral4 behavioral5 behavioral6 behavioral7 behavioral8 behavioral9