General
- Target lMoW3Kh399MkgiiFgS4mMwwcTVW6gikWE3g3Qed.JS
- Size 3.9MB
- Sample260730-vhs3kssfmd
- SHA256 eb69e29e048ba5f4f87035365d335f6ea238b24b7aaa576a2a215ed7eb17bbcb
Score
10/10
Malware Config
Targets
-
- Target lMoW3Kh399MkgiiFgS4mMwwcTVW6gikWE3g3Qed.JS
- Size 3.9MB
- SHA256 eb69e29e048ba5f4f87035365d335f6ea238b24b7aaa576a2a215ed7eb17bbcb
Score10/10-
Detects DonutLoader
-
Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE