donutloader | c92c08047dd767a559667f57b3774ad83aa0e3c3914b22e2756a9b627651b82e

Sharing

Copy URL Twitter E-mail

General

Target
16a71f12fd93d52f2fd4153d9f991ed10a29c9c79bba76da65e7c1518abb4cc2.zip
Size 10.4MB
Sample260826-md3gfswgrh
SHA256 c92c08047dd767a559667f57b3774ad83aa0e3c3914b22e2756a9b627651b82e
MD5 02848fab012db0d9872cda56d89414ac
SHA1 c09c5826838b7e7591b3f567061149ed7b27d601
SHA512 9ea0910b4895a87925b3497512e0ae6aa42eb8fecb9af746cc0c117c60968f90efc4c047614aa78b8445d87a2bfffd1c3a2d6d1fd617ed9fe6f37ca315c7d587
SSDEEP 196608:+NJX0QMes9BJfwYIzoH4phrJtszXeJxt3BC8bzy5W3uAvkBCP7LqaYDZO:SX7s9LfwYophfs7OxJ1baW3u+5j1YDZO
TLSH
T127B633198CA2F32393C722F3272E96DD0F8C5C086561FEA9475C49BF95BD046E8066E7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  16a71f12fd93d52f2fd4153d9f991ed10a29c9c79bba76da65e7c1518abb4cc2.zip
- Size 10.4MB
- SHA256 c92c08047dd767a559667f57b3774ad83aa0e3c3914b22e2756a9b627651b82e
- MD5 02848fab012db0d9872cda56d89414ac
- SHA1 c09c5826838b7e7591b3f567061149ed7b27d601
- SHA512 9ea0910b4895a87925b3497512e0ae6aa42eb8fecb9af746cc0c117c60968f90efc4c047614aa78b8445d87a2bfffd1c3a2d6d1fd617ed9fe6f37ca315c7d587
- SSDEEP 196608:+NJX0QMes9BJfwYIzoH4phrJtszXeJxt3BC8bzy5W3uAvkBCP7LqaYDZO:SX7s9LfwYophfs7OxJ1baW3u+5j1YDZO
- TLSH
  T127B633198CA2F32393C722F3272E96DD0F8C5C086561FEA9475C49BF95BD046E8066E7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Full_Unboxing_Process_Inspection_Record_41042_2026.zip
- Size 10.4MB
- SHA256 16a71f12fd93d52f2fd4153d9f991ed10a29c9c79bba76da65e7c1518abb4cc2
- MD5 872502ea5aa959a1bdf660ecc17fd84d
- SHA1 c7a4790e72a81c91f7badec639598d3261fd232d
- SHA512 3a7bbebf8f07a02d42404aad4b7d0d609585e8815daac2a5b23488766c4a54dc27f88996c37333e52a131e74d9362b5277e4f079eeef7f6c2bcfae5bca8e82c0
- SSDEEP 196608:upjyXARPusyABj+bje7GSRhc7Us4cbr1uMrzjty+BZJiQ3TUH8bO3l4M:upj4A1+bjQFRa7r4c4OsGZJiC08bO3N
- TLSH
  T1A7B633AA1978FEC2E4187726B5CFA210D253CD45E6E49730BD563403296FFA73838E94
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  AppVIsvSubsystems64.dll
- Size 198KB
- SHA256 c0975fa0d7f4d280d656d27a63908d7a1b6e1e61d6c347e6e670bbadb3b15f3e
- MD5 eee3765fe4556fd68d0ab467861a5b18
- SHA1 be3a7fcb8affa5752f2be416fde50046007e7323
- SHA512 82d9948a383ee265af476eae12abb6cfb15c2fb0c22ebd382a46e6af585223a47dfbd1cc5a5b89e74f71a46714480449ae1ef740c12339f6afd3611782fe2305
- SSDEEP 3072:bCTmC+RskU9v2fx3d/Utd9QKCgXJSd3ms6bkKW495zRqRWt1gjWzW3xOxz:CvoxtMt0YJSd2x4iedWSB4z
- TLSH
  T18F147C5577E600F9F9739138C9930616E67678214720DBEF13A0477AAF2BBE0913E722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery execution donutloader loader persistence spyware stealer
- Detects DonutLoader
  loader
- Family: DonutLoader
  DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
  loader donutloader
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral5 behavioral6
- Target
  Full_Unboxing_Process_Inspection_Record_9862_2026.exe
- Size 1.5MB
- SHA256 afdb4a8384812e907a73b59df0fb303af2ba94994b5f4bbb66a51ce2b04e7c32
- MD5 11e550124454f08d2c9572d518380644
- SHA1 140500ac9e396e89507e376f4bf1802da832b1bd
- SHA512 bbb5e96c228be5e9ce572697df39a3a066e45c595517635f7d27f5f73fd474431504cc44fe01f56ad7ad2fc6cc03c8fdfc74f551dbd547129aa5c40ef30bc70a
- SSDEEP 6144:JMQK6Gi1ti6FzyDW1T3yDW1TjkAzkAZqrEdrEAZUCwFjNNaY9Sb:JMz6Gi1gk6kfNPqrEdrEqb
- TLSH
  T17A751E03F63AFCAAF96D3CF1D888DE902C0F3C5A8A8779613976FA5ED5331916600255
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

adware discovery execution persistence spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral7 behavioral8
- Target
  cache/propsys_6915bf20.cache
- Size 18.0MB
- SHA256 34f5891d4e6fc72b0a80d6e8065de995286b53b3f733aa4bea7c5d7521324409
- MD5 240aef08976f69b16619479014a84c45
- SHA1 8efec5ad078931a62e0fae2e5a99a00c9ab7c163
- SHA512 0fc491993af6751ae1f4f2f210929f194d8e2b889f2b58d50c2df5669d7973281e8003070a50bdb001409286f8eb5bb481428baedfaf15b4a33b0ce328404b33
- SSDEEP 393216:qEfzqFVjzQPmisH8gyJSoHI4ApXDsQi3vM0i9N3L8VDvrW:PpD4oHIjXDvifM0iz3L8VDvrW
- TLSH
  T11517D06CA7AEB05571699FAA84953FA6C7F3300B96C93309757CE3CD441EBE14C81BA0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9