General
- Target 9668f8d6a6a7eb197fdedf972496fd1354dd7896388f94f2b6159cf9f2954abb
- Size 118KB
- Sample260923-d6m3ssde27
- SHA256 9668f8d6a6a7eb197fdedf972496fd1354dd7896388f94f2b6159cf9f2954abb
Score
10/10
Malware Config
Targets
-
- Target tedutil.dll
- Size 102KB
- SHA256 557cf95c92e71251ff02ae876b25d0e80e67ad61b08b3f18543edaf9cb52c3f3
Score10/10-
Detects DonutLoader
-
Detects Overlord RAT
-
Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
-
Family: Overlord
Overlord is an open-source Windows RAT written in Golang.
-
Executes dropped EXE
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
- Target 稅務查核企業名單_11509.exe
- Size 222KB
- SHA256 1688fe4698c45680851f5d90aff71fffdccb19c1b283a8c10cbc729c8efca7d8
Score10/10-
Detects DonutLoader
-
Detects Overlord RAT
-
Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
-
Family: Overlord
Overlord is an open-source Windows RAT written in Golang.
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.