General
- Target DU767504.zip
- Size 2.0MB
- Sample260831-vvmrbszsdv
- SHA256 95ec6bfa85025f4e5b8b650a9ba68967d2d30cd1ea5a07079397bd28627abd80
Score
10/10
Malware Config
Targets
-
- Target GST_Filing_Overdue_GSTR-3B_GSTIN07FGHIJ3456L1Z9_Due_20082026.exe
- Size 5.5MB
- SHA256 e0ee8df47283ea4b1db8662dc7409b9069753de14754258b761c40b4e0cb19c2
Score10/10-
Detects DonutLoader
-
Detects Overlord RAT
-
Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
-
Family: Overlord
Overlord is an open-source Windows RAT written in Golang.
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
- Target badata_x64.dll
- Size 80KB
- SHA256 08df9570aa413de375aea42c560fb33723c4b27b717dfbf51a79f450d2cd3e98
Score10/10-
Detects DonutLoader
-
Detects Overlord RAT
-
Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
-
Family: Overlord
Overlord is an open-source Windows RAT written in Golang.
-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Executes dropped EXE
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.