donutloader | cdf418f32115622d6102a59c43e42b97796319681d4ac3879beb2f1fc9f9bb6b

General

Target
cdf418f32115622d6102a59c43e42b97796319681d4ac3879beb2f1fc9f9bb6b
Size 2.0MB
Sample260918-wd3a5aba34
SHA256 cdf418f32115622d6102a59c43e42b97796319681d4ac3879beb2f1fc9f9bb6b
MD5 6573f815da6e95ec496e69b512025a78
SHA1 e6558fadce585e4c9356d3dc40ca4ae2e2bdd509
SHA512 a29ef63d926778f6d644e498f85b0302350eee2d6049cb35d5079b8abb4bba76c0975724060329809c40c8b5d907fc9552f830457fbcbf53bf80353244b0780c
SSDEEP 49152:3gWKkmq/yakrosn2urak5nYjV0g+D8A05iMQzgSwdb:3ikmakrVn2QnYjV0gS8A054gSCb
TLSH
T162A533DD5F988A76025FEC8484C6C92EA6B805C849CF93F1683ECFDAD510416C5ABF78
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  AL MOHIT TRAVEL TOURISM & EET Reziv-BOOKING SOA #20260919.JS
- Size 5.5MB
- SHA256 08726d821acae17d6c10359ac4dd52f0a4951d5b8aa34c80b7e3905959707efc
- MD5 520c57b6d109bccf1804c41de3c33625
- SHA1 a42f8134b915f0800ae9367a706e246035f9f213
- SHA512 7b7a602fd92e6316d05a4755c580dd303e74ae4e8a46987200619f1694d17a55a523f2ad25d9d1237e0ec33e831374c38cba4d43142ba7684abc5c16d66f9294
- SSDEEP 98304:djd70GBUigoJZ6HtB7Res0axTHajkH1sz3Xm2Wj5wXsHZmYYlLLaUgzC3fvS6IjI:dh704KoJZ6NneC8eszvW1woZul5gzC3Z
- TLSH
  T133467F411B44B23B3339A79D52369928E629D4030AC6CF34315ED1FB7B2C98F935EAD6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

execution donutloader remcos loader rat suricata
- Detects DonutLoader
  loader
- Family: DonutLoader
  DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
  loader donutloader
- Family: Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- Suricata alert: REMCOS RAT Malware Inbound C2 Communication
  Network activity triggered a Suricata alert
  suricata remcos
- Suricata alert: REMCOS RAT Malware Outbound C2 Communication
  Network activity triggered a Suricata alert
  suricata remcos
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

JavaScript

1

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Detects DonutLoader

Family: DonutLoader

Family: Remcos

Suricata alert: REMCOS RAT Malware Inbound C2 Communication

Suricata alert: REMCOS RAT Malware Outbound C2 Communication

Checks computer location settings

Executes dropped EXE

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2