Extracted

• • Target
    file.exe
  • Size 908KB
  • SHA256 b9f9c58e080f1b5028e8e331fdc0aa5d5c43646d747031615d4645800fe87a02
  • MD5 219811d86a84844199c1d502295e15b6
  • SHA1 7bafb786a4079e616f448a5325270a8952269098
  • SHA512 1fef3a245aa54d386782d0f78cfb7f9c082f37f2c8265d5434d09513f06726f2524123802866407b3bbc115fd9ff11e0289bd9d17147e0beaf3560b670fba17b
  • SSDEEP 24576:cNVls7y8yuRGvzNUW+ExexPzAishglLL9E1g:cNJ3A3IkRAis2RLS1g
  • TLSH
    T1A0158E22A3D34433D1721A7D8D1B56649B2A7F033D37E9492AF40B4C2E3978976363A7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiondonutloadergcleanerinstallerloaderpersistenceprivilege_escalationspywarestealer

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • Suspicious use of NtCreateUserProcessOtherParentProcess

    defense_evasionprivilege_escalation

  • Downloads MZ/PE file

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops desktop.ini file(s)

  • Suspicious use of SetThreadContext

  behavioral1behavioral2