Extracted

• • Target
    09d74e4be2a2bdcc024b06f897be54a6e8a2c07ecdebb3af1c8729708ce62e4e
  • Size 7.4MB
  • SHA256 09d74e4be2a2bdcc024b06f897be54a6e8a2c07ecdebb3af1c8729708ce62e4e
  • MD5 e76289fa10f1aca28b2c4c6d5c295314
  • SHA1 4e08fdae15c326abc3264752abc5d72964091d93
  • SHA512 e2df7ce414ccc6bdee073439166308875f33dfa65c4ae96e8ffa3f52113a3f69adb5a6a19c65740e003f4e4244cb653703e24ef94dea0d61a4055a7b9c15f9c5
  • SSDEEP 196608:UXJyG+CS3QYEoMxlsjtYbeTwDjYOu/R45DbLJOwQG5e7Q:UXJyG+CS3QYEoMxlsjtYbeTxz/R45wmB
  • TLSH
    T17176BE22B690C837D4734634CC2B97F5653ABE24AF248697B3A17D1C3FB5390391629B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  f46edfcaadde734ab670fcd857e4e0f9discoverydonutloadervidarloaderstealeradwarepersistenceransomwarespyware

  • Detect Vidar Stealer

    stealer

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2