Extracted

• • Target
    Tax_Notice_23665.exe
  • Size 118KB
  • SHA256 93dd8b7b393289f88493596faa4ae70054d9eb4fe47f2dd334f0c6bb5262f2a8
  • MD5 1605971fa40b7f784311cecea47a251e
  • SHA1 9fd5870678ae20ffe9cc8c26068e75935f27957d
  • SHA512 39b5009020a2330d46a746ded44081c8ce0b08a608520ccdc3745f4b98020a537afd2872fed848c1d12321f3e90312297e436693db5017801726a14e115078de
  • SSDEEP 3072:dfYomTuROFcA8eTRuznTVTX3xOcODofsdp9:dgouuTQTR4nl3yAsdj
  • TLSH
    T126C36C5B63E530E9E1B78678C4914A59E776BC7107609FEF03A0425A2F272D18D3EF21
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutiondonutloaderpackclientloaderpersistence

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: PackClient

    PackClient is a Windows loader written in C.

    loaderpackclient

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2
• • Target
    nvdahelperremote.dll
  • Size 444KB
  • SHA256 7295090c2cb63ebc43f932451971c41f9d015d2741e97ae3d9855f5ae87cff94
  • MD5 1f23d7cc6d6354c0e7b24eaa0652d96d
  • SHA1 7ecde045e2d31a63312d7cd9c482e0d4aa74c7fc
  • SHA512 6b9d778105e37d59f965ddd62f7c168534aad6c3055f5ae432fde12026cd9cb1464dba0abecf8fe6bc3d18fa5c37e0f5f871d39192802266e2cb7fde00a51131
  • SSDEEP 6144:mrD9MHURHn18ScLDmy7OG1rQi5zeM4/hzcoAsYd9WAnnnOD9LJo:mNMAH1W3lF4/h4oAFd9W9LJo
  • TLSH
    T137A4AE58EBD177F3E23220B872D8CA8A07C4DED7D1D491B3ADA62C1D4AD591208F2977
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutiondonutloaderloaderpersistence

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral3behavioral4