General
- Target crypted.exe
- Size 33.1MB
- Sample261019-tfshlads9v
- SHA256 77e9cf81cdce11cbd48154909d817bfa4c86793d25d8c69ac0410026b7bce935
Score
10/10
Malware Config
Targets
-
- Target crypted.exe
- Size 33.1MB
- SHA256 77e9cf81cdce11cbd48154909d817bfa4c86793d25d8c69ac0410026b7bce935
Score10/10Detects DonutLoader
Detects Overlord RAT
Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
Family: Overlord
Overlord is an open-source Windows RAT written in Golang.
Reads WinSCP keys stored on the system
Tries to access WinSCP stored sessions.
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
Reads ssh keys stored on the system
Tries to access SSH used by SSH programs.
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
5Credentials In Files
4Credentials in Registry
1