donutloader | d928718cee5a99e8fc2f855dc785988bb9bee4c1bcec97af9ee94c733910f5a6

Resubmissions

24/08/2026, 13:09

260824-qdxsraybkf10

24/08/2026, 13:05

260824-qbrhystwhs10

Sharing

Copy URL Twitter E-mail

General

Target
FULL_DOCS_Technical_Assessment_1.zip
Size 580KB
Sample260824-qdxsraybkf
SHA256 d928718cee5a99e8fc2f855dc785988bb9bee4c1bcec97af9ee94c733910f5a6
MD5 156c75013f84f75ed10e7e2bee741e3d
SHA1 617e2290eefec622cfbcf98c385fcf0f772416d6
SHA512 81f46f6544dd73030034b1c87c469f1b2fda7370c6ebe4a42b7be3bf8f113bd6c7396d587976fd371b2975dcda4003de6dd2e79eed3a6c553337e3f52dde75bb
SSDEEP 12288:CQFSU4tdR7ubcWQJKj9Y6CrvNp17hhdA9JxUW5VJxf3vZ:CQi70JkKxje1p19U3U0VJR3vZ
TLSH
T1AAC423D8412DFA4A950C3C765F3DC8617ACA786A38D13A6214B3369D098F9892D33DDB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  FULL_DOCS_Technical_Assessment/Technical_Assessment.exe
- Size 1.8MB
- SHA256 270fe63cca8156911303ebdf9481bc99e4265c878cfd41964b2a94131f6c41ad
- MD5 70e0815badcaa9a7cf24bb6ea0ed686b
- SHA1 265f200dc8cf0a38bf683b2f95fb37374fba852c
- SHA512 f22d88d31b9702bd037ce99360fef8bb04fbadbd07373fafc93182e08a413aa9e0db98cface93cec2d9b51cd6d0edb9ce629d249610184a4d8612470839ca62e
- SSDEEP 3072:jMfuZuTpOeyp0uTpOMckAKckAGDpA5NlKrss1ywKrss1ySZDvYONDzVFdC5wFVH2:4fF23FukA1kAb0rEbrESZU8wFjNHIs
- TLSH
  T198958C83EA3AFD27FA6C38F5D888D9A12C0D7D650AE3747239BAF76E94335115B00152
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery donutloader loader persistence spyware stealer upx adware ransomware
- Detects DonutLoader
  loader
- Family: DonutLoader
  DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
  loader donutloader
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2
- Target
  FULL_DOCS_Technical_Assessment/f3d0a498
- Size 39KB
- SHA256 8446f6af941e98ecab103055bc1e77ee73599b2c6d7b997a43107b282f86070a
- MD5 4aab28f0340fefa5a839704e8cea5c9c
- SHA1 078e3ab7733029b9d276ce78984e3d4f452f75fb
- SHA512 10937a00de6409e833bb5a482f25a3a6d949666ec427077f4754cd9cb3a2b494084cbdf080885db340d77e079bf163065076a4995ca2a93f7e9726d5b4abbb42
- SSDEEP 768:he30DjJypNz6tgRlWRfaCRWrY/CGD5uLiNTKUUFbvYVfoZ4Mw:E32y3WyRlWRbr/CGD5uLmdUxQR
- TLSH
  T1B403F2B4992A5331E8A2A77458319DF2F378C590C082BB5D3C77929ED0E2B8DBDD210D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  FULL_DOCS_Technical_Assessment/msvcr100.dll
- Size 29KB
- SHA256 a087a5fc44892dcfadc8f4d2044e7c0ac792ee73ad2cde54604d37e805ddeba5
- MD5 37c6f81d47c87cd12e219cda2485184c
- SHA1 9b958a0f9656469adc35e494c7b37031db83acc1
- SHA512 5d00f2f1332c0d90bfe11fab6f4dfe9c4e8938f68cbec8a35307526593ff37347fe136aaefa21999f3e987fffd39d294e6aae2ec0e7411d5fb1d97ce45e803f7
- SSDEEP 768:8jrFOsimj6MW5xokBDCypPch68gW+GXa+rCoEicZ7B7N:qOsimj63xokBDCype68USioEHN
- TLSH
  T14ED24C85EB67D1B1F5C913F4386F770A8A733D240635AD93A3F03F46A8225B1AA2D610
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery donutloader loader persistence spyware stealer trojan upx adware ransomware
- Detects DonutLoader
  loader
- Family: DonutLoader
  DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
  loader donutloader
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral5 behavioral6
- Target
  FULL_DOCS_Technical_Assessment/msvcr100_2.dll
- Size 29KB
- SHA256 3b4ef6c625971d587de5f8b00d992692eed9baea0ed773a889eebcc5a42a5a33
- MD5 de6f949f9066d81fe30fc4b52e52ac59
- SHA1 a7bc31f5788d002d6d1fbc18fa5fff9d940879ce
- SHA512 4c3be06a0de2eb941c13772afd10e961bd34699380ba451d92803fa684fb30abe0106795edf181ae6a82faa666ffc139f20f73bdfb355f014c1f958607ccc14e
- SSDEEP 768:8VyRUYimj6MW5xokBD8yJBwhukgW+GXautcokIFZ7Bw5:nUYimj63xokBD8yJQukUS6okZ5
- TLSH
  T129D24C85F763D1B5F5D913F4386F770A8E733D240631AE93E3E03F86A8225A1AA2D550
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery donutloader loader persistence spyware stealer upx adware ransomware
- Detects DonutLoader
  loader
- Family: DonutLoader
  DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
  loader donutloader
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral7 behavioral8
- Target
  FULL_DOCS_Technical_Assessment/msvcr100_orig.dll
- Size 358KB
- SHA256 88f9f246a26ea05d11c286054d094cea2b30749e41bbd12b22eff3f6cb882f73
- MD5 eb2cf85787881fa15b8abf7f441660e6
- SHA1 659256c2cb57aabcd61455d5f554dbc9322a8487
- SHA512 68d2a2798d5beae32835e921bae6fa59db53139da5f2a491d0e11e3cf8fd9a4d0b2f5ea852dc705469bbfe3bce51039092a9ce7046ff463183287cceeb4e8b76
- SSDEEP 6144:1Fx7o5Doe4vyKHAEOwb9fURWcSKoIywtOzcHV1/sNeeSn1VBEVgSUdhE0g/bodZy:1UZoe4HATm4SnIE2u3qBEVbUXjemCy32
- TLSH
  T16E7412B4AC5B59B7FF97D2718964C52B087B1F4065814396900D9FAC3BC4B2CEB31A2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral10 behavioral9