General
- Target 所得税の確定申告に係る納税通知書4.zip
- Size 120KB
- Sample260915-hmt48ashld
- SHA256 ba0a76532db536e62034c212536f3e60594cd2248fdedc9ba73b8a2380367f99
Score
10/10
Malware Config
Targets
-
- Target 所得税の確定申告に係る納税通知書4.zip
- Size 120KB
- SHA256 ba0a76532db536e62034c212536f3e60594cd2248fdedc9ba73b8a2380367f99
Score10/10-
Detects DonutLoader
-
Detects Overlord RAT
-
Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
-
Family: Overlord
Overlord is an open-source Windows RAT written in Golang.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
- Target event.dll
- Size 52KB
- SHA256 61df4487225b6af0d2bcc6e4332603d82c72d9a058517b208eeb89533ff3f02d
Score10/10-
Detects DonutLoader
-
Detects Overlord RAT
-
Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
-
Family: Overlord
Overlord is an open-source Windows RAT written in Golang.
-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Executes dropped EXE
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.