donutloader | 398b1d4f8757e84cf9b6919ec686126089f5c6728601ef03fe7a51723aae33eb

General

Target
TDS_Penalty_S271C_PAN_KQDGJ2902W_Q2_FY2026-27.zip
Size 118KB
Sample260925-r593tseh46
SHA256 398b1d4f8757e84cf9b6919ec686126089f5c6728601ef03fe7a51723aae33eb
MD5 f19f1e2f5d45b76b093e8bce3a197232
SHA1 e9a9245076a8fc260ace751d2235de33b0fbecd8
SHA512 e2f48b47e7086a0e29edd97ae421c5516bc18de913c9a6eb9d1a766ea974a791c1ea27131959623043c839d2e10354a2b7098ad3bc6a4a58556e72891a291d9c
SSDEEP 3072:1aZEpWASft5BwcnDqKc9G8zbX3nm6BcA3FvHiK:k0WASBDqdLzbW+cItHiK
TLSH
T1AFC312845ABB55BEFCC05DB311E55EE337262AD64C3A6E8EEB7854DC40085ACC32D238
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  TDS_Penalty_S271C_PAN_KQDGJ2902W_Q2_FY2026-27.exe
- Size 222KB
- SHA256 1688fe4698c45680851f5d90aff71fffdccb19c1b283a8c10cbc729c8efca7d8
- MD5 0b631263c1d1584a0e8fc21bf3ee3093
- SHA1 2ca980a55e99bcae8927e65a13b22e927b9f8620
- SHA512 4059af60b446ff26ca1b7a70ce0a0567a323d3c037faf9d0f849bb1dcf30dea95813abc46435e0308f6c0cbe5098c1f82d87f114217eb6cdd33d17b14fdf98f9
- SSDEEP 3072:5jZ8yFFYIzNBapJw/pV2JdqLVZjHAhQ+IgNo36J3BJicSyt:bEESJdqJZjHCO36ZRt
- TLSH
  T14A24F95272E440D0E3A963398522DA99EAB17C26976193CF8350767A1F33BD39C3B31D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery donutloader overlord loader persistence rat
- Detects DonutLoader
  loader
- Detects Overlord RAT
- Family: DonutLoader
  DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
  loader donutloader
- Family: Overlord
  Overlord is an open-source Windows RAT written in Golang.
  rat overlord
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
behavioral1
- Target
  tedutil.dll
- Size 100KB
- SHA256 8adfbf4394c4720894b945881e7469ac12b2e84d6a230fd665f552daaefe2d20
- MD5 26678579b952af98c490560b7942492d
- SHA1 c9472c0ec7b3f3c196893050922ec46e831d8ce1
- SHA512 be6c363ad5b01488d26604e41822f5fc16e78b7f1f4a1d79dd9f3369439146ec7520b3633e681d2807c0895f77e59c5c00d4725aa763e03e6c624c1493265680
- SSDEEP 3072:FQgoVDdmUR4eBtNWNwfJVcbHOg56TkNeU7S/4PHkNSLYWRorydlGfYNtCYOv0Yi:FC7RVkHOg56TkNeU7S/4PHkNSLYWRorW
- TLSH
  T176A356456574BCB8C526803D9203632297B23C4DC33266A7AAE5DD643F97FA06B3D7E0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery donutloader overlord loader persistence rat
- Detects DonutLoader
  loader
- Detects Overlord RAT
- Family: DonutLoader
  DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
  loader donutloader
- Family: Overlord
  Overlord is an open-source Windows RAT written in Golang.
  rat overlord
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
behavioral2 behavioral3