donutloader | 11007d9e770004600c19af5a67056ca577c96fc09fdb438d35588e66bfa18bd2

General

Target
LB%40_l5xmfb.zip
Size 907KB
Sample260705-pdfnssct4w
SHA256 11007d9e770004600c19af5a67056ca577c96fc09fdb438d35588e66bfa18bd2
MD5 884219b58fc1de0c1605a22763390a5d
SHA1 11082b37190ceb8bd43defb62de0eb4245d2d4df
SHA512 cb82d835102144b8e01c55192e15953d6b236f2fd8dff9392007859e4017ab125f0a85b28f24df24f50af3b0f32e4f34f6d22b073e7e23da95fe33ec15bc7ecc
SSDEEP 12288:EuXJY6yE6nB7AqQYwhaOsBJ3onWejjE1gbKsRnxY6i3hI5MR7u00ZUCwlqnGIZCb:Za7DnB7dwWvQIjsRxYN3Ljkw6jZ0x
TLSH
T1051533D89381CD783868377AAAA335B0BCC0791FD957C4E12F73CBA04653591EE84A6D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  update_l5xmfb.bat
- Size 657KB
- SHA256 1f2766971b02e8e7014e8c31071d8cede5288768c986ebd81452437dee15a6d0
- MD5 0d1316c3d60ce063dbc0299a7a00c341
- SHA1 97471ea4755913626d000e61ed9c8664dd2c800b
- SHA512 ea53d485f157f28975612f58275579523a888af5270f5b57f335c214b083d57e15b5d156b1893f54489281e1bb793973a69718242ac8e811fc9c999c5297b36d
- SSDEEP 12288:kQQyMmiW6+/uP7zGtVWYwEdz7iXjX7u3LolMr/N7LGTkxk:FMMuP7zgw8nyPZ6FHxxk
- TLSH
  T18CE4237E3F86A9557C2D9896DB3DA40C7C2FF0A74BB4CCA0A987F0B251554C8BB1C41A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery donutloader loader spyware
- Detects DonutLoader
  loader
- Family: DonutLoader
  DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
  loader donutloader
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Deobfuscate/Decode Files or Information
  Payload decoded via CertUtil.
  defense_evasion
behavioral1 behavioral2
- Target
  usbmon_l5xmfb.dll
- Size 14KB
- SHA256 f270886b12702cb3c74be3b80a834a184bddf19137dacdb948e43a0abcdc1b90
- MD5 3827f7b4f2275f15667992eb156fd236
- SHA1 3a259062413d606ad979715bed0f70fdd5bcba88
- SHA512 a524db68aa0a021d6103ef2bbfdeb00a0a8c1cb5e1f474c10963c04959c92d3863cb771cbbc2021969c034f256b561f6a7203f8075e3eb69de1b0206acd7fd50
- SSDEEP 192:BoutinExrCuLW2LH7Ilv81KM215voyvm01d4L/:BoutiFuLWMH4gdWtom1d4L/
- TLSH
  T1B552A80D3292D8E9C50DC47981EBCF79AAF5B801C9D75B3C4734DA362EA07A5362AE05
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

donutloader loader spyware
- Detects DonutLoader
  loader
- Family: DonutLoader
  DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
  loader donutloader
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
behavioral3 behavioral4