donutloader | 9f583b4169cd9cefa34b05e800fc0283291943e53cca03c5f004a649e9fda5b5

General

Target
GST_Non_Filing_Notice_06RRTJE7550U3Z4_Sep2026_23092026.zip
Size 118KB
Sample260923-sr5rmathje
SHA256 9f583b4169cd9cefa34b05e800fc0283291943e53cca03c5f004a649e9fda5b5
MD5 ee323ed4b2cbf43bd26c85ef44b0434d
SHA1 d4e3be50ce0e2e7e8cd83fc210155813d07c0981
SHA512 442f569d54a6d54d4b6c5bbb55311f9c28b8a604db2146a9146d2f58e7c6c945fe6641b01e17e4708501982ff83cc746d2f7ecd423254d8040f3816523ecaabd
SSDEEP 3072:FaZEpWASft5BwcnDqKc9G8zbXL26UU21LfcXX5iD:00WASBDqdLzbLG1AXXi
TLSH
T11AC312609E16597CF8D41CF161E47AF22332689A087B3ED4FB7C58982118A6FD35E36C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  GSTR-3B_Overdue_Notice_S47_06AAAGC2597F2ZI_23092026.exe
- Size 222KB
- SHA256 1688fe4698c45680851f5d90aff71fffdccb19c1b283a8c10cbc729c8efca7d8
- MD5 0b631263c1d1584a0e8fc21bf3ee3093
- SHA1 2ca980a55e99bcae8927e65a13b22e927b9f8620
- SHA512 4059af60b446ff26ca1b7a70ce0a0567a323d3c037faf9d0f849bb1dcf30dea95813abc46435e0308f6c0cbe5098c1f82d87f114217eb6cdd33d17b14fdf98f9
- SSDEEP 3072:5jZ8yFFYIzNBapJw/pV2JdqLVZjHAhQ+IgNo36J3BJicSyt:bEESJdqJZjHCO36ZRt
- TLSH
  T14A24F95272E440D0E3A963398522DA99EAB17C26976193CF8350767A1F33BD39C3B31D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution donutloader overlord loader persistence rat
- Detects DonutLoader
  loader
- Detects Overlord RAT
- Family: DonutLoader
  DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
  loader donutloader
- Family: Overlord
  Overlord is an open-source Windows RAT written in Golang.
  rat overlord
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
behavioral1
- Target
  tedutil.dll
- Size 102KB
- SHA256 83cfa06e84360705a2fdfa332a8324e37dd9be45f23e37fa4a4a557f46e078f2
- MD5 24d21f9c82d4c8525fe473d125afa223
- SHA1 88ed135a0b687f9b2c90d54f7ca33e5cde3e9e4e
- SHA512 8e0a8644a3ad21195bd40785161f662692b899a3fd229e08e7dc653b4b8fcd2b2164b562e9b445e89c9d0079b03ca6a6e5115604317f5374cb0b1658fdf18f6e
- SSDEEP 3072:Qqmc7LsppHxb1WhINEBkofoLmT5Onk6lsPGBIejgFm8MChYXfMFiroBRl/XmFMff:Qqmc7LcoALC5Onk6lsPGBIejgFm8MChE
- TLSH
  T139A357456575BCB8C526803E9207632293B23C4DC3316667BAE9DD243F97F606B2E7E0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery execution donutloader overlord loader persistence rat
- Detects DonutLoader
  loader
- Detects Overlord RAT
- Family: DonutLoader
  DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
  loader donutloader
- Family: Overlord
  Overlord is an open-source Windows RAT written in Golang.
  rat overlord
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
behavioral2 behavioral3