General
- Target 2026-08-03_61db4683746da580f865c9801d6a6227_snatch
- Size 17.3MB
- Sample260804-dcqa3abh62
- SHA256 5101d15e1afec27819a5870960cac84e0b2d737b62c603badeb1f91d03618b3d
Score
10/10
Malware Config
Targets
-
- Target 2026-08-03_61db4683746da580f865c9801d6a6227_snatch
- Size 17.3MB
- SHA256 5101d15e1afec27819a5870960cac84e0b2d737b62c603badeb1f91d03618b3d
Score10/10-
Detects DonutLoader
-
Detects Overlord RAT
-
Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
-
Family: Overlord
Overlord is an open-source Windows RAT written in Golang.
-
Detects executables referencing many IR and analysis tools
-
Detects executables referencing virtualization MAC addresses
-
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
-
Creates a file in the Startup directory
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Scheduled Task/Job
1Scheduled Task
1