General
- Target c0510abe4aa40e2f80d568d6c916bd36e58815a993ad76d1e8127c98e2260f2c
- Size 3.8MB
- Sample260824-v4benaec94
- SHA256 c0510abe4aa40e2f80d568d6c916bd36e58815a993ad76d1e8127c98e2260f2c
Score
10/10
Malware Config
Targets
-
- Target YoudaoDict_fanyiweb_navigation.exe
- Size 4.8MB
- SHA256 2f8a4b9af79025520d2b7b498748222b2cf9f5f04a3564a7892c57fa4dd9c358
Score10/10-
Detects DonutLoader
-
Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
-
Executes dropped EXE
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.