General
- Target 118.exe
- Size 415KB
- Sample260830-3hrthsbk9y
- SHA256 3610fcc54a204281b09095004f02b674cd75bdd83996a1428fdef85645eff3e1
Score
10/10
Malware Config
Targets
-
- Target 118.exe
- Size 415KB
- SHA256 3610fcc54a204281b09095004f02b674cd75bdd83996a1428fdef85645eff3e1
Score10/10Async RAT payload
Detects DonutLoader
Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
Creates a file in the Startup directory
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
Executes dropped EXE
Loads dropped DLL
Adds Run key to start application
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
- Target C:/Users/Public/Documents/11.exe
- Size 202KB
- SHA256 db413d7a7f36a922d30489d4df22d8fecd4da3a6e08f0a227ca770d6afa24bc3
Score1/10 -
- Target C:/Users/Public/Documents/dbgeng.dll
- Size 417KB
- SHA256 5c19d5539749b0b0264d5b482731081d411b7168d0010233cf38c6fb24f4d1ac
Score1/10
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2