donutloader | 61c5d953740a8aaed77f6c8632150c9e47ba4687b1c48b9d3b77e713e64cf736

General

Target
Meccha-Trainer.exe
Size 70.1MB
Sample260629-n362lses9k
SHA256 61c5d953740a8aaed77f6c8632150c9e47ba4687b1c48b9d3b77e713e64cf736
MD5 e7ffd327d286383f3276183bea1f83a7
SHA1 5a6f8c3eab441f3b6d74e372a61f3f482093f584
SHA512 cb06f8c4c3f7d75ddea2b43905ecf6053ce4acef971fa1320d4c3c0d6fa85bee342b73cb536c34dc0fb7dd8a0e94f42dcd85aadc0887a541cb819513fab0e881
SSDEEP 1572864:VLdk99GBO2E61FIABZI48z2Fi/S8JKBUmy+N5Xe6EfB7m7:V29EOTGaABZVPArg/bXeB7m7
TLSH
T191F7339097964655D08B5FF9613F17E3AE2B0EF0625DA0AF02B78872F4A9427C6CC14F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Meccha-Trainer.exe
- Size 70.1MB
- SHA256 61c5d953740a8aaed77f6c8632150c9e47ba4687b1c48b9d3b77e713e64cf736
- MD5 e7ffd327d286383f3276183bea1f83a7
- SHA1 5a6f8c3eab441f3b6d74e372a61f3f482093f584
- SHA512 cb06f8c4c3f7d75ddea2b43905ecf6053ce4acef971fa1320d4c3c0d6fa85bee342b73cb536c34dc0fb7dd8a0e94f42dcd85aadc0887a541cb819513fab0e881
- SSDEEP 1572864:VLdk99GBO2E61FIABZI48z2Fi/S8JKBUmy+N5Xe6EfB7m7:V29EOTGaABZVPArg/bXeB7m7
- TLSH
  T191F7339097964655D08B5FF9613F17E3AE2B0EF0625DA0AF02B78872F4A9427C6CC14F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access defense_evasion discovery execution donutloader loader persistence spyware stealer trojan
- Detects DonutLoader
  loader
- Family: DonutLoader
  DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
  loader donutloader
- Suspicious use of NtCreateProcessExOtherParentProcess
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
  Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.
  defense_evasion
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- System Binary Proxy Execution: Rundll32
  Abuse Rundll32 to proxy execution of malicious code.
  defense_evasion
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Hide Artifacts: Hidden Window
  Windows that would typically be displayed when an application carries out an operation can be hidden.
  defense_evasion
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  Installer.exe
- Size 168.1MB
- SHA256 f1fdb3e045eff53d860bb757980dd194b392910fc8a9b640bae912388cda9c4c
- MD5 df2352fff1deec3d9690c5957093130e
- SHA1 1eefade8d8bc0b9f7bf1807e9b376340e8aa907c
- SHA512 d5c98a909df656a48b7c389776578ce0886a544ebe0e5d5884a02f39f5780289e1deba7397941ff6839dc45a028abcd7f6c6656d3e9838d4aad2ef4d229f54fd
- SSDEEP 1572864:wgRMg/aKxl4b7qCDQtjovZT78wLF2pArKgDz6ObiISXD+Dyj3eRalD2kGpTe/2Hk:cg/geeFXzGa9Fz
- TLSH
  T144887B03E2DA50D9F05DD1B18B979633EA72B84A4728B6DF265407162F77EE02B3DB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access defense_evasion discovery execution donutloader loader persistence spyware stealer trojan
- Detects DonutLoader
  loader
- Family: DonutLoader
  DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
  loader donutloader
- Suspicious use of NtCreateProcessExOtherParentProcess
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
  Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.
  defense_evasion
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- System Binary Proxy Execution: Rundll32
  Abuse Rundll32 to proxy execution of malicious code.
  defense_evasion
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Hide Artifacts: Hidden Window
  Windows that would typically be displayed when an application carries out an operation can be hidden.
  defense_evasion
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral3 behavioral4