General
- Target main.exe
- Size 1.2MB
- Sample260707-blz6hsb17m
- SHA256 8d1fb9a8c5781dcc8ac110f426c5517261bffce3b26087bd43e71037e086de05
Score
10/10
Malware Config
Targets
-
- Target main.exe
- Size 1.2MB
- SHA256 8d1fb9a8c5781dcc8ac110f426c5517261bffce3b26087bd43e71037e086de05
Score10/10Detects DonutLoader
Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
Suspicious use of NtSetInformationThreadHideFromDebugger