donutloader | 468b3fb1c5cb75392f657a9417d1533ee36b096f9a0d6dbd915022d144ba0739

General

Target
13082026_0349_12082026_CSHSE26-00370.rar
Size 1.5MB
Sample260813-edf98a1dkg
SHA256 468b3fb1c5cb75392f657a9417d1533ee36b096f9a0d6dbd915022d144ba0739
MD5 9ba3af2af52555378afe6057ea7d0264
SHA1 2e8c90a5c49a9df7f1fac41f41afa3b87c534ee1
SHA512 831bd4b1b7a2f77b8ee8cb839f55c3a56250e2ed5711613f91289cf1d2b11cd5b7c84431e51a3e598f82d208989387cd0e61a9fe484e9b7c1a8d4a7f6b6e2712
SSDEEP 24576:MKMZt1L3s8S0PJ70/W/6O5uQvltzGJ2ssR6ZpwEwZ7c9eh3rExsFzpzpcN33owuH:9wL3st0Ro+/XuQvltzS28oPZYeVE8zpj
TLSH
T1296533C0937D6B6AEE32F8D51C72DFB7E09E390121BD1464D4FB811E42BB916B9A9C01
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Credentials

Protocol
smtp
Host
mail.trimnt.com
Port
587
Username
[email protected]
Password
her6+eMmNJbim&[F

Extracted

Family

phantom_stealer

Version

v4.0.0

Credentials

Protocol
smtp
Host
GvnHcUROw6Pcih6HwY0rEpWUXo3/axSz/ToyZIkLTq9QAAAAX6rN5ZnJgYKiA8C06yEztrUjFM4W0MRjboNfRpwYHBsJ1UYzLQPRLki9k5dX5QoN/eKJPeGs7kJ2gdIjL+7emmVkqxgdRPAZdUUvjwpLBbcjFxIRzk0rmkO5z4VK06nc
Username
HyZbuZW4URd0sMq2cKzT7GMpxkawTghgZSRFWbIJyQBQAAAAQ1cXF6G7v69qJBtlpbZ73z1h+B7/Ju60MjuORLb6y7Dfn+uWQwgafscjV49jxYKCNPJbA8sya3pprBknYzu0jjp/WF2N75KjxzRNUbvQjzyQuv3U7IZ7Upje/A2iUo5a
Password
gzy/TnRvsw56mFR251My7v9hqLbpOPLzyVNw3pUlvYxQAAAA4CJmFHNVV/0LhyjQWwIZ0DqZP21OKqOBcyIoNJn4d3U+Vn/RkdF/BLhMhckWQoptUDKEFXjiqXD1apy/CTi51c/YTZHUz4WA6RIWzbjbn0WGZejeu6aqQ+HbJPCHUQZzF6WZo7K8qS0Y7Pvn9TzZ6A==
Email to
D4YkHm0Og6XlAGOa/SPxQCoTsE0utCkmoLaH1bo2kJJQAAAAN3nLnaLBnypHJljKydOKAbslf/HziY0fyy8HK57KYkKvwA2jJST/u9GFxKe4bkBmw2sth8vVJCWZlIy0OdGnexStY08AAQTxVxbq0AxFuVdC1HTYo9ypXgzmUIaH+HNuw97kIQNfGKamhbUtflYirg==

Credentials

Protocol
ftp
Host
0
Username
0
Password
0

Mutex

S7FHVGSFZV79T8D372PY

Wallets

3J6rebMcc9JpV67Z/dW8Besklg2H2cpQzKIMeYSuER1QAAAAUx7EY5VCjmSWLUA1gGPRKBKh6tbl2mwnmewGr2hdpVNYadWeyGeC1c2jGHQkl5dfoRpRfPrCPe7KHXYj4Quvlrdz5NckBVbZSXvfykBV3Q6ngyXN+208oM5YEGX5yah7e2tPvktXkxzFwb1uU6v7tOqTemcuAD/AHsfshQP6VqQ=
2yC5mKgVrOv0B0HwwRvdA+wNwxWMNxM/LO9CxMw1dfZQAAAAH9Mgs8ds8GavB6Sgtz77qhB99UDTBJcYV7Y3y1ZDiQ4R6HfqIQcbv+txNlhPyFTxjZRwH+jdXzWIF/VY9MN7OCFLijJDeaAqlOnt6WZT+FTM6+3F5zhKz88cC0rPREbsiN8CtK+hk2tp+OqHkp/1ALX1+BWIMYfK7zUe2jwmfoo=
sJQ/ndefDuHTj8vyO/RrIpZ6EbwG1sT7Br8d0+LSpYFQAAAAhPdzAeazmc82GT17szKz3IbnHNO8Fn157jkel0ICDWuh0R+6oIvPYHOUimXwniG4tcmiuDZLUyrxp2cC9A4NgRyo5o4nNFSUqTXG3Aecu6zEgiovr9nCXBqTyhvuzFEqNA56fr9PTsBYlOQ7agNUwYiV3M5cVrge8H0OLOBaqLg=
r5iuHWuRqBVLClF6p06ays7LkgDORUSUyqPDlV2CA8BQAAAA93EVKdUZppOoXsA1axC1YwrRJRT4vmcDQC7P6W08IYEYcbLmsJorOKUyhlVUORe0qeiIlxQubDsSSOI/0riVsaYiyxVCctnhb5+Ass9OAkwiMlyzvSQ2v/loWONveYkDKlTlg+eQZB0fE+TIt6Xfq3RIZmHEKCIbm+eIh4w86ys=
o37qblIaKvhOl4WxO2tbGMSJL3epj+S+EH8U3Z4txlZQAAAA0ZPSCFhkTkK8SuD61dcEUAmWAdWQUk/HNl+V3yvrxTNP2Iv963vaUJY5LlppoQBTAOy6R5Y3QlRjdrB78G1p6cRSJifagA796wn2+X5LUxwXFSqSVVaaoJz4jNqTLYPzb3EVBfCmQ+yl/2Ay+q9a8Zaa+LYGAq/8G1gQYYxF3cH8H4n29UtD4v6dSkBb+nht5uxEE5TOUZCCjxPNmRZ3cp+5D5999pNOqmwEE4BfOPI=
227UOeN0jf8v3pyIJEGeepqQbeISXpBoaX1t24a0leNQAAAAxw4ieqfKjhSAsL0tUSUuWZbARpaTvuaSCO8QFV/aak2k+LPEbOtbRLP5lEZrfj8Y7asYdr/rWYgB3eCratU2Cj98em3Amesb+tTOZPIH9tHRUSeGIFjFDpeZ8L+nXmo2RSaArUkT44OfBq3584tnNCQrz4tvZIFvahc7yhQb8Ec=
/eVieA5C86PG89MFwwhTLnz/UiWB0fWjc0p2FqD4HdFQAAAAfMyvFYCWy5HrhxRbQE1lBUcSpqc+y3ucqNx9VHZRC5yd4ndQpxUITRz287ceZa988T3LCa4yWOganmbhLl/YdxFN31u3N7d2EqW9ARW7jSBEFF7o68iyTRAVA3OIVTzvUIlVgDFWgk/gcN/enZRawTSdEe0HXqS21xRpyZ7pc5A=

Attributes

clipboard
true
clipper
true
credit_cards
true
enable_ssl
true
keylogger
true
passwords
true
screenshot
true
smtp_enabled
true

Targets

- Target
  CSHSE26-00370.JS
- Size 3.8MB
- SHA256 0d3736d9100efb706e9dc200b87f1834a9c2196c4c1ef625700d8946b123ee26
- MD5 769d47bffc692029346b697a1eaac442
- SHA1 90d30345fdcb3ac3681e1c65ceabe6d38306c05a
- SHA512 39e4ce049fdbf02fe8a360080692790ddb2ad235a65a4f6ac4020444e47646798a1b62d6abeec55b9decce7ffe99c4f4411a014617afb0aeac5fc95584a4146c
- SSDEEP 98304:7T5o5QvFXGr2IPClqVGZfCLYAMuvN/IaMt8K2HxXGLZSZWZ1GK71t0tc:bFXGSgClqkJuYkpMO4ZoWZjJ
- TLSH
  T17006A3412344F5327326D76CA276AD7C940A6BC336C5CB59B06CD2183B2ED275B4CAEB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection discovery execution donutloader phantom_stealer loader persistence spyware stealer
- Detects DonutLoader
  loader
- Family: DonutLoader
  DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
  loader donutloader
- Family: PhantomStealer
  Phantom Stealer is a stealer written in C#, forked from the Stealerium family.
  stealer phantom_stealer
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Suspicious use of SetThreadContext
behavioral1 behavioral2