General

  • Target
    76cd69aed94747cb8785f610312640347348fde87277564e69db5e6a6797734b
  • Size 738KB
  • Sample260713-e5v8fsbz4p
  • SHA256 76cd69aed94747cb8785f610312640347348fde87277564e69db5e6a6797734b
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

  • Detects DonutLoader 1 IoCs
  • Revoked Certificate in Chain 1 IoCs

    One or more certificates in the signing chain have been revoked, indicating potential compromise.

  • Codesign digest Mismatch 1 IoCs

    File was altered after it was signed.

  • Untrusted Codesign Signers 1 IoCs

    Codesigned file was signed by an untrusted entity.

File Explorer

  • 76cd69aed94747cb8785f610312640347348fde87277564e69db5e6a6797734b
    .zip 738KB
  • MSVCP140.dll
    .dll 613KB
  • TenioDL_core.dll
    .dll 238.2MB
  • VCRUNTIME140.dll
    .dll 116KB
  • caesalpiniaceous.exe
    .exe 189KB
  • emjio.tmp
    40KB
  • vcruntime140_1.dll
    .dll 48KB

76cd69aed94747cb8785f610312640347348fde87277564e69db5e6a6797734b

  • SHA256 76cd69aed94747cb8785f610312640347348fde87277564e69db5e6a6797734b
  • MD5 SHA1 SHA512 SSDEEP TLSH