donutloader | af05c0b7aefa3554b15792bab2ed7460b011d62ae64841541ebc24a33dd103d6

General

Target
Notice from Tax Department.zip
Size 770KB
Sample260715-khdyjsbs41
SHA256 af05c0b7aefa3554b15792bab2ed7460b011d62ae64841541ebc24a33dd103d6
MD5 38dfb8f27ed78234ed82350d80ea2599
SHA1 01d3b735168582614844b6bd2392de079eb4e94c
SHA512 9f91d712177412e1683a571d80809be8e4f1dfa10166dde69a9bc839da3d6a51c917ace4044710f2f8dfb93851f4e26f538784fd5eb38f45afd1dce7020b5412
SSDEEP 12288:4cTHHERNTheXe5urVD/MW8C8KdKV3AwYS12ojrL5XusLkcyqyi7axon:4cbHEJU778CdKNYS1v+xFXi7axG
TLSH
T13FF4332CF7F8AAC2F2619C7705D4B4041B02339EDDD68291242F67779C21667F1256BE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Notice from Tax Department.zip
- Size 770KB
- SHA256 af05c0b7aefa3554b15792bab2ed7460b011d62ae64841541ebc24a33dd103d6
- MD5 38dfb8f27ed78234ed82350d80ea2599
- SHA1 01d3b735168582614844b6bd2392de079eb4e94c
- SHA512 9f91d712177412e1683a571d80809be8e4f1dfa10166dde69a9bc839da3d6a51c917ace4044710f2f8dfb93851f4e26f538784fd5eb38f45afd1dce7020b5412
- SSDEEP 12288:4cTHHERNTheXe5urVD/MW8C8KdKV3AwYS12ojrL5XusLkcyqyi7axon:4cbHEJU778CdKNYS1v+xFXi7axG
- TLSH
  T13FF4332CF7F8AAC2F2619C7705D4B4041B02339EDDD68291242F67779C21667F1256BE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery evasion execution donutloader loader persistence trojan
- Detects DonutLoader
  loader
- Family: DonutLoader
  DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
  loader donutloader
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender Real-time Protection settings
  defense_evasion trojan
- Modifies Windows Defender TamperProtection settings
  evasion trojan
- Modifies Windows Defender notification settings
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Enumerates VirtualBox registry keys
  defense_evasion
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Looks for VMWare Tools registry key
  defense_evasion
- Executes dropped EXE
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  defense_evasion
- Loads dropped DLL
- Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
  Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.
  defense_evasion
- Adds Run key to start application
  persistence
behavioral1 behavioral2
- Target
  Notice from Tax Department.exe
- Size 98KB
- SHA256 26c642331d6c1fb00a5be9895c636c7e4db7912a4d2920e896ee1ccf3a2a40e5
- MD5 7f39ef3ca59c27cd5c2ef318c2560a5b
- SHA1 ca589e4bba6e5afc7647db76ae0a74d925454e92
- SHA512 440bb37866485526400023eaf32cb549d0111df748f20de4f07fe3d4a0c61435f7543e10fd20dccfda177c158220b2f7b8c19a377038d78ab093f775a8c70c6d
- SSDEEP 3072:TYOGW9bZsPU804u2xXibswbelywU2vBh06:cWF+p0yibO0wU2f
- TLSH
  T179A3294997E834D4F5FA9B34457592147B30F9652B219BEF09A080790F22BD08F3EF6A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery evasion execution donutloader loader persistence spyware stealer trojan
- Detects DonutLoader
  loader
- Family: DonutLoader
  DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
  loader donutloader
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender Real-time Protection settings
  defense_evasion trojan
- Modifies Windows Defender TamperProtection settings
  evasion trojan
- Modifies Windows Defender notification settings
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Enumerates VirtualBox registry keys
  defense_evasion
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Looks for VMWare Tools registry key
  defense_evasion
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  defense_evasion
- Windows security modification
  defense_evasion trojan
- Adds Run key to start application
  persistence
- Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
  Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.
  defense_evasion
behavioral3
- Target
  netutils.dll
- Size 901KB
- SHA256 e8a4f2026d5aac1b74acbf7033ea0ec626055d3dbf5d645c9f741a75ad17ea37
- MD5 19659624f5327852b451e55d42f10814
- SHA1 fe41e0792240db27a1068884baf31d9f8971a50d
- SHA512 4adf498455d378031d6276a3610a81964554562ec41a668b599f0679201d4b28e3eb73ca9af278b62224d874db17bca45e84a5770a490b64b0209cbb7cf782ef
- SSDEEP 12288:zLAjMiKK1sILWWldMs9ZFdIW7NQCfaSUPinvmPFzLdJ5tMo2uaTcIoUX6mdJY9S4:zCRTNnaeQCfDJJuUKSJCSXUGQn4/uR
- TLSH
  T1AC15E01CD62D0D2EDA230EFDD07A48D6D12AA5E32AC7402737F589E786D3398508FE95
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion
- Enumerates VirtualBox registry keys
  defense_evasion
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Looks for VMWare Tools registry key
  defense_evasion
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  defense_evasion
behavioral4 behavioral5