donutloader | 046df0cc6074d51f205b2be671cd3cb516e8afcc0ca161d393e09bf88b9c66f0

General

Target
046df0cc6074d51f205b2be671cd3cb516e8afcc0ca161d393e09bf88b9c66f0
Size 1.8MB
Sample260803-graqpsda42
SHA256 046df0cc6074d51f205b2be671cd3cb516e8afcc0ca161d393e09bf88b9c66f0
MD5 e682c51c617165a1b29b01dd8bc31c51
SHA1 8b6567099c6909afce8ccf02d43840f2b2bba5cb
SHA512 d9a2b7d8276ca9ecbe592299885ceaaf5337f17b72ad320d0179fb60582ccf55141fc3d82c18927042ee6daa8c5258d132cd53f0edd1c1e60eb01a607a3a92eb
SSDEEP 49152:/kPJqUgwMAkYfDk/nKDG5l5tD9O3UBFif4W:/kPJqbAkYfDmgGj5tD9OBv
TLSH
T16B8533CF0933BD6DF2760501E42F0DA7A05C782551B1E2398C22FEAA6BE76BD057D924
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Credentials

Protocol
smtp
Host
mail.trimnt.com
Port
587
Username
[email protected]
Password
her6+eMmNJbim&[F

Extracted

Family

phantom_stealer

Version

v4.0.0

Credentials

Protocol
smtp
Host
GvnHcUROw6Pcih6HwY0rEpWUXo3/axSz/ToyZIkLTq9QAAAAX6rN5ZnJgYKiA8C06yEztrUjFM4W0MRjboNfRpwYHBsJ1UYzLQPRLki9k5dX5QoN/eKJPeGs7kJ2gdIjL+7emmVkqxgdRPAZdUUvjwpLBbcjFxIRzk0rmkO5z4VK06nc
Username
HyZbuZW4URd0sMq2cKzT7GMpxkawTghgZSRFWbIJyQBQAAAAQ1cXF6G7v69qJBtlpbZ73z1h+B7/Ju60MjuORLb6y7Dfn+uWQwgafscjV49jxYKCNPJbA8sya3pprBknYzu0jjp/WF2N75KjxzRNUbvQjzyQuv3U7IZ7Upje/A2iUo5a
Password
gzy/TnRvsw56mFR251My7v9hqLbpOPLzyVNw3pUlvYxQAAAA4CJmFHNVV/0LhyjQWwIZ0DqZP21OKqOBcyIoNJn4d3U+Vn/RkdF/BLhMhckWQoptUDKEFXjiqXD1apy/CTi51c/YTZHUz4WA6RIWzbjbn0WGZejeu6aqQ+HbJPCHUQZzF6WZo7K8qS0Y7Pvn9TzZ6A==
Email to
D4YkHm0Og6XlAGOa/SPxQCoTsE0utCkmoLaH1bo2kJJQAAAAN3nLnaLBnypHJljKydOKAbslf/HziY0fyy8HK57KYkKvwA2jJST/u9GFxKe4bkBmw2sth8vVJCWZlIy0OdGnexStY08AAQTxVxbq0AxFuVdC1HTYo9ypXgzmUIaH+HNuw97kIQNfGKamhbUtflYirg==

Credentials

Protocol
ftp
Host
0
Username
0
Password
0

Mutex

S7FHVGSFZV79T8D372PY

Wallets

3J6rebMcc9JpV67Z/dW8Besklg2H2cpQzKIMeYSuER1QAAAAUx7EY5VCjmSWLUA1gGPRKBKh6tbl2mwnmewGr2hdpVNYadWeyGeC1c2jGHQkl5dfoRpRfPrCPe7KHXYj4Quvlrdz5NckBVbZSXvfykBV3Q6ngyXN+208oM5YEGX5yah7e2tPvktXkxzFwb1uU6v7tOqTemcuAD/AHsfshQP6VqQ=
2yC5mKgVrOv0B0HwwRvdA+wNwxWMNxM/LO9CxMw1dfZQAAAAH9Mgs8ds8GavB6Sgtz77qhB99UDTBJcYV7Y3y1ZDiQ4R6HfqIQcbv+txNlhPyFTxjZRwH+jdXzWIF/VY9MN7OCFLijJDeaAqlOnt6WZT+FTM6+3F5zhKz88cC0rPREbsiN8CtK+hk2tp+OqHkp/1ALX1+BWIMYfK7zUe2jwmfoo=
sJQ/ndefDuHTj8vyO/RrIpZ6EbwG1sT7Br8d0+LSpYFQAAAAhPdzAeazmc82GT17szKz3IbnHNO8Fn157jkel0ICDWuh0R+6oIvPYHOUimXwniG4tcmiuDZLUyrxp2cC9A4NgRyo5o4nNFSUqTXG3Aecu6zEgiovr9nCXBqTyhvuzFEqNA56fr9PTsBYlOQ7agNUwYiV3M5cVrge8H0OLOBaqLg=
r5iuHWuRqBVLClF6p06ays7LkgDORUSUyqPDlV2CA8BQAAAA93EVKdUZppOoXsA1axC1YwrRJRT4vmcDQC7P6W08IYEYcbLmsJorOKUyhlVUORe0qeiIlxQubDsSSOI/0riVsaYiyxVCctnhb5+Ass9OAkwiMlyzvSQ2v/loWONveYkDKlTlg+eQZB0fE+TIt6Xfq3RIZmHEKCIbm+eIh4w86ys=
o37qblIaKvhOl4WxO2tbGMSJL3epj+S+EH8U3Z4txlZQAAAA0ZPSCFhkTkK8SuD61dcEUAmWAdWQUk/HNl+V3yvrxTNP2Iv963vaUJY5LlppoQBTAOy6R5Y3QlRjdrB78G1p6cRSJifagA796wn2+X5LUxwXFSqSVVaaoJz4jNqTLYPzb3EVBfCmQ+yl/2Ay+q9a8Zaa+LYGAq/8G1gQYYxF3cH8H4n29UtD4v6dSkBb+nht5uxEE5TOUZCCjxPNmRZ3cp+5D5999pNOqmwEE4BfOPI=
227UOeN0jf8v3pyIJEGeepqQbeISXpBoaX1t24a0leNQAAAAxw4ieqfKjhSAsL0tUSUuWZbARpaTvuaSCO8QFV/aak2k+LPEbOtbRLP5lEZrfj8Y7asYdr/rWYgB3eCratU2Cj98em3Amesb+tTOZPIH9tHRUSeGIFjFDpeZ8L+nXmo2RSaArUkT44OfBq3584tnNCQrz4tvZIFvahc7yhQb8Ec=
/eVieA5C86PG89MFwwhTLnz/UiWB0fWjc0p2FqD4HdFQAAAAfMyvFYCWy5HrhxRbQE1lBUcSpqc+y3ucqNx9VHZRC5yd4ndQpxUITRz287ceZa988T3LCa4yWOganmbhLl/YdxFN31u3N7d2EqW9ARW7jSBEFF7o68iyTRAVA3OIVTzvUIlVgDFWgk/gcN/enZRawTSdEe0HXqS21xRpyZ7pc5A=

Attributes

clipboard
true
clipper
true
credit_cards
true
enable_ssl
true
keylogger
true
passwords
true
screenshot
true
smtp_enabled
true

Targets

- Target
  RFQ_784990SN6.JS
- Size 3.8MB
- SHA256 28359d2d8054f8650bfdb99aa395ef2bba62846005e3f4748b2aca8f173f8bcb
- MD5 ea38b7ce3db67ad4398028718af6b0e3
- SHA1 0990c8cfa97a5ad7e1a0cba45cb51456df39fdaa
- SHA512 3e1043c6268ae28a21d80c2afc4371798f3c7efc2ccc92a57f9a56d0eae3c080a9dd7bff4bce42c7a6f06003b9635e6e6c4f9026fedaf06b66a4d0770f0d0b6a
- SSDEEP 98304:YpQRiM1arm2HEBz9lg8U1vIcF/nqaH04XwIEqg7oaCg3nrB1Hx5fEo:YpQE/2TgNvtM4vEqgxVd1R5
- TLSH
  T15506C381274491337321AB9C5336DAB2D92E12A314C6DB0A717DE2197F7CD0BE358AF6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection discovery execution donutloader phantom_stealer loader persistence spyware stealer
- Detects DonutLoader
  loader
- Family: DonutLoader
  DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
  loader donutloader
- Family: PhantomStealer
  Phantom Stealer is a stealer written in C#, forked from the Stealerium family.
  stealer phantom_stealer
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Suspicious use of SetThreadContext
behavioral1 behavioral2