General
- Target 5005be9940b3ebb29ad2b16d0a2eb2292da921b78a72a614d347ba2048ae78ef
- Size 130KB
- Sample260930-j4lpvaysev
- SHA256 5005be9940b3ebb29ad2b16d0a2eb2292da921b78a72a614d347ba2048ae78ef
Score
10/10
Malware Config
Targets
-
- Target 115年度預定稅務查核企業名單.exe
- Size 250KB
- SHA256 abcb44b459e9f101106251bb9b4b7a07163554af450d0e61636417d12499cf2f
Score10/10-
Detects DonutLoader
-
Detects Overlord RAT
-
Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
-
Family: Overlord
Overlord is an open-source Windows RAT written in Golang.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
- Target event.dll
- Size 101KB
- SHA256 369fdbd5cb5b0b64537c4cada9e6f3bff936d73f638cbe6bbd2d4db9f882b053
Score10/10-
Detects DonutLoader
-
Detects Overlord RAT
-
Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
-
Family: Overlord
Overlord is an open-source Windows RAT written in Golang.
-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Executes dropped EXE
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.