donutloader | 257d2ea43188a7c9c885877e38e231265115f9825300e494643e84ece78dd584

Sharing

General

Target
3cpvye.zip
Size 37.0MB
Sample260816-ef443azvdz
SHA256 257d2ea43188a7c9c885877e38e231265115f9825300e494643e84ece78dd584
MD5 ff7d0b260ef4df24e99c9228c7a01e4e
SHA1 89437e440f68dbccde211252a2bb8cb27593abd2
SHA512 b86a7c26446404bd9968eda0107844d8331c5170352b35f58c958ac03aa4da57235767d35da01ef0fb568b895ba29f6634bd7ad6d99caca10ebecd8a33651bcd
SSDEEP 786432:NbtkhFRv9Ye918BzVx5sPPTMkXX3lesYoF4Ii44sJjs9n2CGhcb:N+zYfBztsnTMkH3YsYo+Ipts9n+U
TLSH
T11C8733E1CE78AF5962CC3A72C0072F5052E9229685535ED7EB2807E35791BF1CCD2DA2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  3cpvye.zip
- Size 37.0MB
- SHA256 257d2ea43188a7c9c885877e38e231265115f9825300e494643e84ece78dd584
- MD5 ff7d0b260ef4df24e99c9228c7a01e4e
- SHA1 89437e440f68dbccde211252a2bb8cb27593abd2
- SHA512 b86a7c26446404bd9968eda0107844d8331c5170352b35f58c958ac03aa4da57235767d35da01ef0fb568b895ba29f6634bd7ad6d99caca10ebecd8a33651bcd
- SSDEEP 786432:NbtkhFRv9Ye918BzVx5sPPTMkXX3lesYoF4Ii44sJjs9n2CGhcb:N+zYfBztsnTMkH3YsYo+Ipts9n+U
- TLSH
  T11C8733E1CE78AF5962CC3A72C0072F5052E9229685535ED7EB2807E35791BF1CCD2DA2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Release/PureCrack.exe
- Size 170KB
- SHA256 df8db400f999fd5fff1e7c6a66215e5da92ef0cfa51ea82e35f421de557e6e7c
- MD5 d26b4d4e7624423215af3e666c586086
- SHA1 f5e14204c6eb7e331cf9f4a658507eea3f8fa6f8
- SHA512 41fd4569d63ebf45a070619242b2f484e46c9f924c5689597f807db075da756ecce5f073e6aecf9939effa557d6646596f737a8d7677f402bdad04561e983062
- SSDEEP 3072:zoXI8BXZjImg0CzfxfqroyfBU1I2ff9esFep/jX3dN8ObUPya4/LlG/bkzjwmYCr:zGF9JIvTJPycjWN8OYKa4ZGgU+V+w7u4
- TLSH
  T19704F744F29E50E8E0668139A8924751BAF37C1507645FFF0B644F6AAEE36C07D3BB50
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery donutloader loader persistence privilege_escalation spyware trojan
- Detects DonutLoader
  loader
- Family: DonutLoader
  DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
  loader donutloader
- Modifies Windows Firewall
  defense_evasion
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
behavioral3 behavioral4
- Target
  Release/PureCrack.exe.config
- Size 553B
- SHA256 9e33249d43563df004ea6a52562bb406f446e4bc2366379bcd7cb785bdf4af77
- MD5 85a933acdcbe62992f8c0032a3d3d2ce
- SHA1 f21f24253fd04bc3a41a11ba1b95b67907db0949
- SHA512 e2fdd98f572818fb09d3a6f839cb645fdeeb0a9340e06706b4cbc8016bd79de3d6b7d81982ccc059ba99a41ae1ddec1eab5e3b3ec8da851abc2a82fff21c5314
- TLSH
  T141F09E2184C8BFA64F724AA33B779464CBB483B32C8C044CB4AF6E974F2159D5207233
- MD5 SHA1 SHA512 TLSH
Score

3^/10

adware discovery spyware
behavioral5 behavioral6
- Target
  Release/README.txt
- Size 1KB
- SHA256 56cbce16fe5acb1f22ea2f4932c26a41c91ab3274ce73ad3de62613a79faa1f1
- MD5 f9ee1190d4a3891e9d7e54695ac24bf0
- SHA1 4c1a39b8252a2c8b87a9b0bbfde880e80037084e
- SHA512 a73827f991d4ec94a8b46af24f58527214644c627473be1df5e06e7d9fa4839de6bea354ec436dfe776e8f049b50cdfb2aea305da507ce93f752b5cd0ba0204b
- TLSH
  T162315193B55F53B09E5329AF3C1060AB677F7126676500406ADF50CCB20A4B8573B8EE
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral7 behavioral8
- Target
  Release/panel/Plugins/PureHelper.Client.dll
- Size 307KB
- SHA256 ed64609ee64110d3b7dd7d719b2b9dac2885b3e1c4e8154ff250fb4325b2648b
- MD5 6ac57c06df411564ea6bcdb169265906
- SHA1 888f3a9f441fb12e0ecc2d2b991f532c43337a3b
- SHA512 2c3c1a1bc432c8def03fb56bd12c824bebd2544d834969a5abc292fb9d47a8e1d5939e8c369f4edafeb965757273c51db3ea66949dfcb9128e9a2766d72c9694
- SSDEEP 6144:bSGWrtJ0P8L1LRSvAeDTyVDS0c1I+pcFVA1Mv7mx:2Gw/pLcvAzxJcHpcFn7m
- TLSH
  T1B9646C4027E4D62BF1BEA3B6E0B916409FFDE40BA15AE74E5C8464FE1D42740BD0276B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  Release/panel/Plugins/PureHelper.dll
- Size 31.9MB
- SHA256 4d13c13d45e24baecc8359a9535f5a2ccdcf1249a56daaef8e42feb1491fa8ce
- MD5 e92c424c9492c88705b40d4c1c9d967d
- SHA1 ac7e6e77a052c254d748479f5572c9d4d37727ac
- SHA512 d8c59e6bef4aad7b709476560e955b41a88e4776b4296454692dda3e4f9b3632fee9b5aa4b3d3ac7df8f1292234fdfe7fbd3e9833eed1ad16cc8a0116a0d8576
- SSDEEP 786432:lfhdClZbxRGECsexG1KuKHS99gaMTZ7/s6h0fbS+:lfhdClZTCUZgSjNMZg60u
- TLSH
  T18877339C987C5EB4DD383D3BB60537242071BA1B98E18FF92B5534C392F501B92A1AE7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  Release/panel/PureRAT.exe
- Size 12B
- SHA256 b89ef90afb3a57ecab37ed5d9205523c06f7027e311bad68d8bf29207098c5d5
- MD5 f715bb510e693bf6ea6f83f4535be621
- SHA1 47d58c25c136378e85fdf1f07c86a1880c054f6c
- SHA512 0485896cb97420b0539941a7dc90a68e693fd2a25f7fa0087a7add4588bf047e2d6af33e3b9b017eba6087dfc602fe528b19c410ebb4b51134da83df503f4124
- MD5 SHA1 SHA512
Score

1^/10
behavioral13 behavioral14
- Target
  Release/panel/PureRAT.exe.config
- Size 4KB
- SHA256 16390e6d3ddba49226dbe581609007fc80b93474f083513aa6a71c0799e6b450
- MD5 7a885376a9a7a18927b67120da837471
- SHA1 2d39e88381d14dc6ca4939261c97ace2ebb8183d
- SHA512 b8aab99f04da9a78b69f9311a1e9e789cd2b12cad99ca1e557edc8189f2b9f585db88567d9dddab2c71c9858ee90bea17861a411f20127357655c58a2af08d5c
- SSDEEP 96:Ley7Fr7147KfuFNDLVEFu/rlTerjVm9qjnXjLuFdxjAXjLupkqgAvp:Ley7Fr7q7zdormonzLknAzLy
- TLSH
  T10581911871C4DE9A06321A72EB718681DFB04363157674A878EE72679F31CCA4BA33B5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral15 behavioral16
- Target
  Release/panel/data.pak
- Size 346KB
- SHA256 efee5150ae55013540e5dccf8c95faf7e82d33e0c8c66d246c76b49876c78c6e
- MD5 6d4435c8f8cf2787ebedfc053a098a19
- SHA1 38dfad14e349fc4c11e01b3f25f7a57b845b4b87
- SHA512 1da44460444dbf3895ee1b701f5206d57e4ccf6df15f83e3bcfb046acf88a876d4f2efca8d700b2c0ba40bd366fb7acb14014cb9dc5e6363e45030ac82a08d94
- SSDEEP 6144:o+Ro1kYg6djBI6nth+kdLWNfpbJTfMHT/mlDG2kDR4zLVGNp/QGWJaxo:ozk/6d9IUtht8hbJTfMHKljA4tGNRQGE
- TLSH
  T16C742329C4BEE90E84DEEA87AC8C24C8C618EA400CFAF944655DD81D55FFDA4A34DF13
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  Release/panel/data/GeoIP.mmdb
- Size 9.2MB
- SHA256 72588bc49d1e5f0003829dd3f85c5659318fe50f6abddac3ff11c0115478a946
- MD5 3d43b992c56939b9e948962e209e6c8c
- SHA1 a5312afbb45ab3407ddd8d7202e805d1167ca2fc
- SHA512 7ca6203ca40687fc1705ff297b2efc1edf452d31d473e4fcae03462d762d010e23d6d2c179304bacf60a2aa5a3b6755d62719b3eb7c99b1b859d4ddf4f68cfa1
- SSDEEP 196608:/Mu5Yk7j/Vky188zmpg2DMaFRoUzfWebv753epJTJZt8MU7zcZ4I:Ea8vMhUb8pJTJZt8MU7zcZ4I
- TLSH
  T17EA67D5B9540DCB243765CC5ED26C0AB4A7355E0C83901A56ED98F8C38C8C6F3B9AEE7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20