donutloader | 21d20edb21ae48ecd87bf44d2bb5a5defb644e83e5615419f5633c54447b1ae9

General

Target
8u9iyg.zip
Size 1.4MB
Sample260724-xyydcabm6w
SHA256 21d20edb21ae48ecd87bf44d2bb5a5defb644e83e5615419f5633c54447b1ae9
MD5 a7dafb87aadba99c5feac917ac68cb7c
SHA1 c3074f49a9e9b44be77763a3131a76f6ce57b185
SHA512 5974ba43d5b00ad64d390666488d50c8d254851e2fd7fcd21684bbdedd2f31dd1489d1714b4b1945f0a053d00869d00f0b0f4829b6d946845ea16b45f7f9034b
SSDEEP 24576:iFRQuULs5GrQXHwIPo7YsqbXBa9t4+5SkkwugEft2ACu90fKHRtKEq4:iQuULMG0XvossqbQt4+5HkwcAxALHRtB
TLSH
T15D6533B1B6FE6E341A63E6015FB024706363DEB5DE04C6DD290B91198EDFB492B4C42B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  patch_8u9iyg.bat
- Size 1.0MB
- SHA256 6945303eb8b013ae5eaaa2071899c50400aed9f7465a2c80802b9d315858a450
- MD5 b2a17bd82047308afb8672cd6f11d517
- SHA1 07cfcbb263c63dad4c18880882d0f7eccc16ef4f
- SHA512 dbf0859d5b6fc7f8cffcb76446eb9bc4646dc06ba827ce0d1fadcbdeb9a966f97e2ef19327fd3e51dc70c68b296c012293745e215ee899912f88e4dd55fa89f1
- SSDEEP 24576:nfhaVv880v9NBXCwDDUVPmsx1TYQBXmGv0OUX9:gm8k9NXoTXBWGcf
- TLSH
  T10325333D3F1929527C1D4545CA3E681CBC1FF8ABA7B5DC059897F5B241A29C8BB0E80E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution donutloader loader spyware
- Detects DonutLoader
  loader
- Family: DonutLoader
  DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
  loader donutloader
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Deobfuscate/Decode Files or Information
  Payload decoded via CertUtil.
  defense_evasion
behavioral1 behavioral2
- Target
  usbmon_8u9iyg.dll
- Size 14KB
- SHA256 d927e11dac042493b09ccb35b5a402e9eb550a5a2a5263b52aedfa70854072d9
- MD5 12caad188354bb95f319335140a251ed
- SHA1 6358277a6b1d756d41564e1d0d949b605a651f14
- SHA512 518c7e54ccf806270f781ccd99ed6aa6de0b82145d0c8ee559b5d9f58d6de0048b29f1b4a868b976fe30371607e35cbf628b7a4b4ffc05444869f43a2c17694e
- SSDEEP 96:GuEtq/3VEgUd/v/F6P0z59VFaA2g4/JAFsWIycj17GBbqPe1ZyaxEAheHSbSnfDf:JEtSFEfdPKuMAFP81Ks21ZyaXeqd4L
- TLSH
  T1B362B70E321358D9C90AD47991EB8F79ABF1B801C9E79B384334DA363E507B5762EE44
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

donutloader loader spyware
- Detects DonutLoader
  loader
- Family: DonutLoader
  DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
  loader donutloader
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
behavioral3 behavioral4