donutloader | fdf542499c311179a287606a50b858b54cfbe2421e90d32663946d5956976d9a

General

Target
2026-07-01_33310ed426b64b6faf303290ebb23321_akira_cobalt-strike
Size 9.8MB
Sample260701-yesjesfv8s
SHA256 fdf542499c311179a287606a50b858b54cfbe2421e90d32663946d5956976d9a
MD5 33310ed426b64b6faf303290ebb23321
SHA1 04b2bef714e8b739639ee4f9987307f4647c6b7b
SHA512 af0825902179ada508ff7bc47638651e78241ed3512ed0bdb100cdbf33c67093039e9eb9ac4c6bd5982943aa38729de70b7f3453444b1d820f9e69bdf55b415e
SSDEEP 49152:aiaBthR9Ht5oyi9LvxihbgcD5Go3AMDm:EHli9LvOuowMD
TLSH
T1C3A6E10377FEB06DE66BC374925566A29A21FC7B0C61A86931DC44660F979003FBC3B6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-01_33310ed426b64b6faf303290ebb23321_akira_cobalt-strike
- Size 9.8MB
- SHA256 fdf542499c311179a287606a50b858b54cfbe2421e90d32663946d5956976d9a
- MD5 33310ed426b64b6faf303290ebb23321
- SHA1 04b2bef714e8b739639ee4f9987307f4647c6b7b
- SHA512 af0825902179ada508ff7bc47638651e78241ed3512ed0bdb100cdbf33c67093039e9eb9ac4c6bd5982943aa38729de70b7f3453444b1d820f9e69bdf55b415e
- SSDEEP 49152:aiaBthR9Ht5oyi9LvxihbgcD5Go3AMDm:EHli9LvOuowMD
- TLSH
  T1C3A6E10377FEB06DE66BC374925566A29A21FC7B0C61A86931DC44660F979003FBC3B6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery execution donutloader loader persistence spyware stealer adware ransomware
- Detects DonutLoader
  loader
- Family: DonutLoader
  DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
  loader donutloader
- Detect binaries embedding considerable number of MFA browser extension IDs.
- Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
- Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2