General
- Target 營所稅文件1.zip
- Size 116KB
- Sample260914-w7r29agl91
- SHA256 6e32a6776b6f68a9bfd5a8acc8a1b37238ea51d7467f807e6c3cbc68b3ea5d9b
Score
10/10
Malware Config
Targets
-
- Target 營所稅文件1.IMG
- Size 1.2MB
- SHA256 7cd4805083b0c78429c8ffcef413949a23c169367903a6fd9432728112aff4bc
Score3/10 -
- Target event.dll
- Size 52KB
- SHA256 8cfbb1c4815319535dad9077fdb4f57fd85fa42ff8167f95ca63c2447bec87f2
Score10/10-
Detects DonutLoader
-
Detects Overlord RAT
-
Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
-
Family: Overlord
Overlord is an open-source Windows RAT written in Golang.
-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Executes dropped EXE
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
- Target 營所稅文件.exe
- Size 250KB
- SHA256 abcb44b459e9f101106251bb9b4b7a07163554af450d0e61636417d12499cf2f
Score10/10-
Detects DonutLoader
-
Detects Overlord RAT
-
Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
-
Family: Overlord
Overlord is an open-source Windows RAT written in Golang.
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.