General
- Target 118.exe
- Size 415KB
- Sample260831-agavdssdjd
- SHA256 3610fcc54a204281b09095004f02b674cd75bdd83996a1428fdef85645eff3e1
Score
10/10
Malware Config
Targets
-
- Target 118.exe
- Size 415KB
- SHA256 3610fcc54a204281b09095004f02b674cd75bdd83996a1428fdef85645eff3e1
Score10/10-
Async RAT payload
-
Detects DonutLoader
-
Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
-
Creates a file in the Startup directory
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
- Target C:/Users/Public/Documents/11.exe
- Size 202KB
- SHA256 db413d7a7f36a922d30489d4df22d8fecd4da3a6e08f0a227ca770d6afa24bc3
Score1/10 -
- Target C:/Users/Public/Documents/dbgeng.dll
- Size 417KB
- SHA256 5c19d5539749b0b0264d5b482731081d411b7168d0010233cf38c6fb24f4d1ac
Score1/10
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2