General
- Target GST_Filing_Overdue_GSTR-8B_GSTIN29PQRSX5678K1Z2_Due_20082026.zip
- Size 2.0MB
- Sample260910-l66txa1frb
- SHA256 1d08f2605fc1f991020205ca38d3518332fed4f26782e579a265cdb3652cfd98
Score
10/10
Malware Config
Targets
-
- Target GST_Filing_Overdue_GSTR-8B_GSTIN29PQRSX5678K1Z2_Due_20082026.zip
- Size 2.0MB
- SHA256 1d08f2605fc1f991020205ca38d3518332fed4f26782e579a265cdb3652cfd98
Score10/10-
Detects DonutLoader
-
Detects Overlord RAT
-
Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
-
Family: Overlord
Overlord is an open-source Windows RAT written in Golang.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
- Target badata_x64.dll
- Size 80KB
- SHA256 81f1a6fe9b5ff6056acf13a2e426a284ce6f54cd1d2b6f4a1a3b498f3bf70c38
Score10/10-
Detects DonutLoader
-
Detects Overlord RAT
-
Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
-
Family: Overlord
Overlord is an open-source Windows RAT written in Golang.
-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Executes dropped EXE
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.