904430b0a61e8441222170655f7471af9d8388b4b31c47a67be803abd135d683

General

Target
DonutDuperV2.zip
Size 3.1MB
Sample260816-215bwsyfpc
SHA256 904430b0a61e8441222170655f7471af9d8388b4b31c47a67be803abd135d683
MD5 f64788479e499a743c9c75dcb1e6a093
SHA1 a799801bb0e04271e051b16a8b4b636d76bbbf4c
SHA512 ab30f97baa241f06a9946a7eddc32798186f6977dc1c2d7534380917e72a1f18ec0b18b00c6ebd2948dec82e82a76badf6880d0939f9b52cf33440ed31e15d3f
SSDEEP 49152:1aThYXgexdMbimUKrrmYFAsSKtv2H3c9peHqaY8aBxBE4lO3Zdhi40hSgIEEmVoV:YNimzrmYeK9peHux24E3Zdh5
TLSH
T1B6E56D55B35434A6FBAAC83585A29313E2B174040B6356DF2E6CC6691F3FBE2123EF05
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  DonutDuperV2.exe
- Size 108KB
- SHA256 2803b74d5466845e4dc9063bd516f3679aa2a3f70a30d9e93976c212e87f6e87
- MD5 8ce68a756995deb55746dee1525edec3
- SHA1 10b1d1fc1dc4f11bef3fea1163cf68a88c29d3cf
- SHA512 f46adf3b92a43b82d0b6ea2652b42a284e25be45909e6c0529440625e7d2867460790778e80864702d56a301e2cb1202006977d8248330a33a4e2212dbbf46d5
- SSDEEP 3072:rPdGIbRRYJTG8xqR8AaP3ZNKkz8rJYB1osiFAQgD5PxzU:znvuLxqR8Aahz91osEAQMlU
- TLSH
  T169B35B9AA39800D8CCA18174D5225217EBF1BC58176293DF0721F3590FBBAE67F3A749
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- ConfuserEx .NET packer
  Detects ConfuserEx .NET packer.
behavioral1
- Target
  glib-2.0.dll
- Size 1.2MB
- SHA256 29f281e0e9ebc9cc7b54af08535509feac1930a60d3d2e2fe9528f77711f04a8
- MD5 74801ead5a1402af905efa4ca76fd181
- SHA1 b08eb2362170048a7b0c08a6339cbf29001fc8c9
- SHA512 9c6d3c2ea2ec6025da828ed4d5688287f6195ba5f999288655430c09379ecf7165dd26c483620cea703c8db7cc796fc98cfc532904188ae413b910f167e659f3
- SSDEEP 24576:Ta0mJzYXgexdLNoLpRimUKr+h5gmYFA+NILwVtvM0E:TaThYXgexdMbimUKrrmYFAsSKtv+
- TLSH
  T1CA452755A64539A7FB9ACC7588A19353E27074080F2366DF3E6CC6291B2FBD7023AF05
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Modifies Windows Firewall
  defense_evasion
- ConfuserEx .NET packer
  Detects ConfuserEx .NET packer.
- Drops file in System32 directory
behavioral2
- Target
  gmodule-2.0.dll
- Size 29KB
- SHA256 ed105b46d3a374db93cc79ce058e897b63dfce9bcc3a27d93ab8f254baeae58a
- MD5 a45eea5bcdd017b9c4535f5c7daaf2df
- SHA1 e25337dd0c49784566a4d83f71130a18704dbcb9
- SHA512 0ce56d630456ca4a91a628ca9729b152dbacc6e2a33b150011715d6a45b8e7512da422d804c13afa4fbd5935e1d42a3efbace43f5c6826c1acf9e053b13f2ab5
- SSDEEP 384:GXlf1IXxPE2Q+FoFR0dRpDhj3aKuqHuej+IYiBpxaV1VF0hXHMGBk7/UMQ3n:ugOR+6SDhb7uAnYi3YV1VaXLkji
- TLSH
  T1EED28D436B5450D7DA05CD7CE8E3A907EDB5B2C08BD152CF2229C6580F263C27BB9768
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- ConfuserEx .NET packer
  Detects ConfuserEx .NET packer.
behavioral3