General
- Target 103.exe
- Size 415KB
- Sample260831-aga56asdke
- SHA256 9b1d38cd728ec1a478db668e86f7445ab5f0335b388feefc15502931cdcad704
Score
10/10
Malware Config
Targets
-
- Target 103.exe
- Size 415KB
- SHA256 9b1d38cd728ec1a478db668e86f7445ab5f0335b388feefc15502931cdcad704
Score10/10-
Async RAT payload
-
Detects DonutLoader
-
Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
-
Creates a file in the Startup directory
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
- Target C:/Users/Public/Documents/11.exe
- Size 202KB
- SHA256 db413d7a7f36a922d30489d4df22d8fecd4da3a6e08f0a227ca770d6afa24bc3
Score1/10 -
- Target C:/Users/Public/Documents/dbgeng.dll
- Size 417KB
- SHA256 5c19d5539749b0b0264d5b482731081d411b7168d0010233cf38c6fb24f4d1ac
Score1/10
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2