donutloader | 7144432f2d523d696ded26ad26f325e86ed22c1b908f788b651755c1ad9e7e31

General

Target
7144432f2d523d696ded26ad26f325e86ed22c1b908f788b651755c1ad9e7e31
Size 1.7MB
Sample260729-fx1zeavepb
SHA256 7144432f2d523d696ded26ad26f325e86ed22c1b908f788b651755c1ad9e7e31
MD5 2601af32b7102c37fe8aa3f391c25610
SHA1 0c569b4638f8a9246fc68aa37b0c565423c7caeb
SHA512 2f9e41a74b8f60d8805745bb68956a2ad26bd82661e717ca9dba3dbc5fcc5091f5f526d5691d90c582dbc9391bd6a48e0532e2f34c15647d0096f13275292f7e
SSDEEP 49152:nn8Wf2o41FdbtM1jMBZhS6toj4ZPr5aIqZWT6Z:nn8Ro41Ftu6BZE6toj4ZT5LEZ
TLSH
T1A38533DE6A27988C24D5EF9FC8B5CD42074B1D0F57D4AA82A14A4602F3DD5381BCB9EC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Credentials

Protocol
smtp
Host
mail.trimnt.com
Port
587
Username
[email protected]
Password
her6+eMmNJbim&[F

Extracted

Family

phantom_stealer

Version

v4.0.0

Credentials

Protocol
smtp
Host
BKzXvOZR/InHS5GMyWH7jQVjpfD8BQhKe4TEuw6Y35dQAAAAdcZDp6utAJQq6Hg9OCjxnsz2POvBve7qKoaHAA2W9fUdKosVIhMhbt/7B85EFq2zEU59rnhpe4KqvmNc3YTR78ltIaIhqQxjNbjKvROlMHmRf56jZqXwcNkuAbGIOR8z
Username
KIAbJslK5pV9JCmRqCgELu4bUOmvlejbYAIVaT9Ap25QAAAAuhaayKbociITNToSt9WKGk/2lq6Bh7F1N8DJGV0tdPnI2olW/xm+8Y1f0erqqvJbWDGIFLAZZQoFBWyjRnRkysCokwKvq3UEquRC5E7hjnZvHJMejGYgAzF+xVMxuuLb
Password
ipb+hYt6c2DzsvV+8lr22vAnRJllGnmg/CexbNLvbslQAAAAZn1I5xdXChmoAOc4Kkmo82eP0F/f20kKPxoBpCACpv0UWiPsEVixZt6zNtMhn4mG1HlYDJiO9i+YPvGiuuR3BHUY9OUOMnJYQ0LW1J1XAGmP2Z1u0VN8bXHmAb6DqcGbw1VmKlBQFCQxUAIv0mTeOw==
Email to
HxeO9xrYhey5oU4isZrW0Xg+CskhckUJfR3YgeeuiFhQAAAAnRGOMvP2qIuFwyL/RpReNhlob9ykv6KAHLejisas4jwx7ezmiQ93LqY+0p4O4wlvYX+AIgIYBaWCHGI/r0sRJCaAnv7m27dGIINjjMA/cmCI11JJKljHfPwZFHYbx6BERywQvc4wa54J/mYkZXO1gg==

Credentials

Protocol
ftp
Host
0
Username
0
Password
0

Mutex

IG7AZ2SLY78ZUAKFFX82

Wallets

ts+WOr5VL54MeSc8tg5yH+THhORbjh+jaJHXGWdsUj1QAAAAvLUhIjqp196asdznZshP+FEe5osBHu/EE2woKZDOEEE0De4b20AzCjyKuvyBPgs1qkfDwuf1UJDgFfNK8qJjnVCSrXjxRf8tMeDH1BEumfxz4lwzm4jF50Ej8PD5WpIhhQa6jwcvRXAwlM/6/PUAoLpR2oMUyy6R/RIR3/oQ4/8=
vBCohBrz6Nud337R4el5+0Rppf0ULivi85qA7scS0ZJQAAAAGIKTaOz2kxn2S5vmk5/2fvdHvntHb6Kf57Je5yQhiB1FCh9X9QwRrSFsYsMvCYgcmcSRfEdV/yivnYiIXMh4Mm/ejKM2ihfrMTSgaqK9MCRiZFOxpk6Vyq+PW6u4cL+GrXAGpziXE/32aXwHBuwOZqMDEpA+mb3CVzq/Rcdb45U=
0GyGuVj6nbuc4+xejdrkKvTi1GGUfbkJKO1RvKdgiB5QAAAA+nb4IwPTS1FhikEGF0C4TZDa4c8ZsFlXgveXKQJX2eY88fkBksHuJATpKVuKqOkG40O8Wiio+I26pEBFxFCpkz+lYc2jx3nIOJc+QGsAUKIT0PbE/yxU6RIA6+RfqAQWO/nuET9VB1+CZhfQTvQ7muwqHQc4fhPa0jF1QKpdJTw=
PD2JoHIDiM/uFbj91kSev+jEIFZjGn+8/iMsLr8gjXZQAAAAtWPkWEG8AB9A4q+bCa9kq7Kqe+eB7yybwQLUkOpzAwSoDqSQE54MvBnQt6vwPiHmbzowOSKC2EapxbCkj0o3ajnMWIo7lMFPY3tf+YNWKLW3VXgb5Gzye4IXB0aJU5cn8BiVo5pMOoY9fEx8F5HQ77QLEgcyW+ydqsNqc7IQ3P4=
V7kZyWvOL6BAYVjnGCwu/+h/31pXia1KKBZb8wO1+OZQAAAAQn4mF8pO4WEPisKuPDyNK1e9JS5yhjZrDxo9gELDNYWJWl6A5mec1UL112RQSqEg3BM8qXeZacEaseEHjDIVpUR/KKc3ursZWBVYZ5LTrrZnk6w7STVBgiB7P+NAxLrCVTgZ3BJ9lYZsXO2vlvFEvE8ylDcTa0dC8mat8VQElSHHcZOSee02dcFLm8eaWt0WmRcrHN475HYf3fIQJHxSeD+vDZgI6LtMe6Fv4N9zEG0=
Hvgc1a9k7/z2cbyAzehAJpotJE1Se4bCU0La/PSegUhQAAAAd9ueFmOxmY2CWSn0GGlNDqs/M+gXO+yHUYa+SPv3aaHyWz8L627td/ZMHQds8bYJPYGfSU/QSUBD+kfodINUMeHyVJPp+FYtsagvmN/MO8Q9DE0cqwqfSW3JVRSfWxN+bnPux1XAFmoOqv7H5oIfAb6JRlM7wXeXry9uIXde8AY=
vBRxO+N4XhX0QX+EkKvRYpqEhnMl/jscuLDM3T9mB2tQAAAAGZOkKptLp1guT0p2NkI+V2P2gc5Jej7v1VaIkXKpAfus/vgGewwn35UFDrHOfpp86IYv81emPzAOyBiuxhHA7O4mx315wPk/L4VkzuKwDMQpF0+MVlA3vrkBYgagy3/q9CuRTz8VPVzamoryJeN1G2Xey964UMWe2bPTmPt1nPE=

Attributes

clipper
true
credit_cards
true
enable_ssl
true
keylogger
true
passwords
true
screenshot
true
smtp_enabled
true

Targets

- Target
  RFQ ARL3220726TN.JS
- Size 4.3MB
- SHA256 b0196d8a25ab7bbb1c9185161e978f21ec473d482cbc9c60cfca0c0c587c9e24
- MD5 d2b2d3e6eb391a8333d1e7cf9e64d8ba
- SHA1 fa5696375bd318fb9bdde6ff81d20ff2c0faeba7
- SHA512 c6b41a50b9f4588acb5941ac481cdb57b359fbb05d6c4140211e8efe186964370975f7ce596e3da7d9431c5cd66659cd9a818bcfdf6200099a02fae1a680ea37
- SSDEEP 98304:yLSZgbxMf9Mwb+M64m2pPw9boeDsWfMg8Pd+WteIxyDvNqsS8H9UZkRJCr3D:yLSZ02fewAYi9bdhC+4UHscSD
- TLSH
  T1BC26F8C297A0AF7E7BA1AB8CA537DA28430D110308C5DF29319ECA15779DD079349EDB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection discovery execution donutloader phantom_stealer loader persistence spyware stealer
- Detects DonutLoader
  loader
- Family: DonutLoader
  DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
  loader donutloader
- Family: PhantomStealer
  Phantom Stealer is a stealer written in C#, forked from the Stealerium family.
  stealer phantom_stealer
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Suspicious use of SetThreadContext
behavioral1 behavioral2