donutloader | 69cfbf277c6dcaadb9044dc4af0ab1665999a76c1442a333a5469f899bc8e469

General

Target
2026-08-03_1e3da51a9eb1e951cfe1043fe38f7d5b_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch
Size 19.8MB
Sample260804-p3kn2ser9s
SHA256 69cfbf277c6dcaadb9044dc4af0ab1665999a76c1442a333a5469f899bc8e469
MD5 1e3da51a9eb1e951cfe1043fe38f7d5b
SHA1 4e02a36de503701b848ebd84f70f19aaee26d49f
SHA512 cad64b51b2aeac455e1a179c5a4bcedbac53c571f6b1b5b705a1dd707dbd1006980da23bb20131697188848ad805d53399173ac4464965ae6e81cf7ad57b5fbe
SSDEEP 49152:hyP44AP3MBMK32xxG8PA2gNhjrATuGEs3XtysvPre6DPQ+c5EArNe71eBUrAOIaT:hyZws7P8yCyT+qc1e6ljQE
TLSH
T19E27F003FC6618F5C0ADE630897A96537F617C890B2123D71B90B6352F7ABD06EB9718
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-03_1e3da51a9eb1e951cfe1043fe38f7d5b_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch
- Size 19.8MB
- SHA256 69cfbf277c6dcaadb9044dc4af0ab1665999a76c1442a333a5469f899bc8e469
- MD5 1e3da51a9eb1e951cfe1043fe38f7d5b
- SHA1 4e02a36de503701b848ebd84f70f19aaee26d49f
- SHA512 cad64b51b2aeac455e1a179c5a4bcedbac53c571f6b1b5b705a1dd707dbd1006980da23bb20131697188848ad805d53399173ac4464965ae6e81cf7ad57b5fbe
- SSDEEP 49152:hyP44AP3MBMK32xxG8PA2gNhjrATuGEs3XtysvPre6DPQ+c5EArNe71eBUrAOIaT:hyZws7P8yCyT+qc1e6ljQE
- TLSH
  T19E27F003FC6618F5C0ADE630897A96537F617C890B2123D71B90B6352F7ABD06EB9718
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor defense_evasion donutloader sliver loader ransomware trojan
- Detects DonutLoader
  loader
- Family: DonutLoader
  DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
  loader donutloader
- Family: SliverRAT
  SliverRAT is an open source Adversary Emulation Framework.
  trojan backdoor sliver
- Sliver RAT v2
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Looks for VMWare Tools registry key
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

2

T1497

Credential Access

Discovery

Query Registry

3

T1012

System Information Discovery

2

T1082

Virtualization/Sandbox Evasion

2

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Detects DonutLoader

Family: DonutLoader

Family: SliverRAT

Sliver RAT v2

Looks for VirtualBox Guest Additions in registry

Looks for VMWare Tools registry key

Checks computer location settings

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2