General
- Target file.exe
- Size 2.2MB
- Sample260716-clhf5sev4v
- SHA256 7bce64f71e61af03a0cf9efc56e81c4113e6541f252c368603fa43974523081b
Score
10/10
Malware Config
Targets
-
- Target file.exe
- Size 2.2MB
- SHA256 7bce64f71e61af03a0cf9efc56e81c4113e6541f252c368603fa43974523081b
Score10/10Detects DonutLoader
Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
Suspicious use of NtCreateProcessExOtherParentProcess
Reads WinSCP keys stored on the system
Tries to access WinSCP stored sessions.
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
Suspicious use of NtSetInformationThreadHideFromDebugger
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
4Credentials In Files
3Credentials in Registry
1