Extracted

• • Target
    https://cdn.discordapp.com/attachments/1531807726643052585/1532226969750732830/yssswDESKTOP-MJ68OIM.zip?ex=6a6c1510&is=6a6ac390&hm=2eb505adbef92cde1668e6b90666b9c1cb7d34eee5baefaaf8da8bb2c2f96b55&

  Score

  10^/10

  defense_evasiondiscoveryexecutiondonutloaderloader

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Drops desktop.ini file(s)

  behavioral1