donutloader | 8fa1216867aa71b2b8afe95581221335a48323c0c810ed39816b6eec1572159e

Sharing

Copy URL Twitter E-mail

General

Target
Phantom-main.zip
Size 2.7MB
Sample261024-snvr9act8k
SHA256 8fa1216867aa71b2b8afe95581221335a48323c0c810ed39816b6eec1572159e
MD5 b6a0e4f6c6b25e2e55344a97f9924984
SHA1 a8076a56db37a4e222c31039a298bef510cb4bc7
SHA512 96d20914342045ca32dcfb06c6704de32bd85d5634724f0d4f0ff2671643794c39d531fa757facab616960a5a1eecbf0897b51065b75a4cba0060a74b0b0b9b5
SSDEEP 49152:08opfrTGY57UPgOvP3euYDi4HCPP7jbbE12icFOrZyVs9mUqOU+Xd2SAjb8wC:Bk57ojn10HCrj3i21eZyVsAUqIIbM
TLSH
T1F2D533D525842442C77E247B3853E4EBF70A5221B87F6F8F1F8224498F927A2762EC57
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Phantom-main/Phantom Technical Documentation.pdf
- Size 618KB
- SHA256 e5191629807aa753c28843418f2acc15411a4cb6a57aadebe4f95d3b70707ce0
- MD5 b81d3d29aa86a35ad9c07ebba7e1b80d
- SHA1 1b6bb89a8ab346d3a2ccfe186a17266cdca680bf
- SHA512 86e83ead5439e9c85935aa37c2b8edb5876804901f5bdce5d6f554703431113645b832d8a8e41f741d754fc95d2e721e6c51c1704f0a3c85de8f952f6c400312
- SSDEEP 12288:MDK1p0L0liZZmhEiauKrLPAU4iZkIf+vGGwNATOVeUaL:MCp0IiZiaBnZ4zGGYAr5
- TLSH
  T1EDD41B039C198B83A46883F8BE171EAC2F5E7B18E5423BFB44250ECB7E645525C9F16D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral1 behavioral2
- Target
  Phantom-main/Phantom/CodeGen/FileGen.cs
- Size 4KB
- SHA256 f7e56a1c55590933dfefcb7a5d8497ac423286913ddd49e69a5c2d8c23b1bbc6
- MD5 9cfc2b2bbb0a1d1711b9c97f0a9a3da5
- SHA1 567b2b9b480b086deeece6c990a4c0613da73889
- SHA512 5429f2ddd88398a2fccfe8373c5c27e27a7b85191afa7cc5c7e1a51e384758619bf163c0580f0afd60ee4dbce6291a4d935302eb795d06b9e76ff2615e2aab77
- SSDEEP 96:Jo4hUXmrdfm7kdAaX4S8WoEOlDMKscOy01ucWaHJ6f:9tfaQQSjh6DMK301utyS
- TLSH
  T1E3A1531A7021063E6E37542597CE60BEE756A35BD3649B90B9DC1E007F39124D4BCEE4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  Phantom-main/Phantom/PhantomMain.cs
- Size 19KB
- SHA256 67a4ef46ec4fe9337e6553c4cce38bd4283aff0fadb105e8b57905fe138c56e1
- MD5 3fd47940d5fdb521cf9b35d673df8bf2
- SHA1 7646af1c1baba9026d2814b7946b76811326d1ac
- SHA512 2505204c96ef7ae2d750885b4470dc414edce13d33e670cfd000cda244d4708d1ce9a89c949b62aae142212d61c15af3f45e27188c47d7dd69ec3a76ad2fc7ff
- SSDEEP 384:YGLb0fevedgHk2Zg6634Qx6SaHCSAOz+Gv4bj78:XvedgEag6dQgSRS/4g
- TLSH
  T14F92942929069A6B8BB36236EF92650EEF26021F57556020BECD02445F7442CD3BCFF7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  Phantom-main/Phantom/PhantomMain.resx
- Size 49KB
- SHA256 d8b31a52c96c8edaeb81c2a00fdb674c667e5484f00e4ef00fb5fb9401c68e5d
- MD5 31330e89876596da014df48cebc478f1
- SHA1 c79df82f42704ca40ea56faa30cfa20d78f8c381
- SHA512 b185cb6b95e6f7cce4ed54db3652739422bd43e932b802b110d109cd7cd400ac50189fc352b78857deba05e66b97afe514eeff754abc16ad30c129a173dda0de
- SSDEEP 768:KjXdskSv6bNZFLaLLC2WU/vsicURi3XhjJt5YxJxEqU316Lc1l:Kj2v6bQeuqci3Xhj5g/E733
- TLSH
  T1D433417998426E5B15BC350433283D79EC6A2CFFC52CF614708C9BC9FF3DA9968A9094
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral7 behavioral8
- Target
  Phantom-main/Phantom/Properties/Resources.Designer.cs
- Size 2KB
- SHA256 0ed13a52c5f459731930a549e8f722dc64176915904f1e41eefd2e1d1d28214c
- MD5 ef6badce8e1c797d0c1a66afa37aee94
- SHA1 6a10f8a888164ed705fd18b93f6bbc02dbbf2d89
- SHA512 0ec64d6f93ba9c54abe5eb4aecb270dcffc034ee6c84da17ced741f1124fe63f777744dc8253eae13c72229cc87df51db9ca20d193440670f9b5b91dd6dd8573
- TLSH
  T11451CCB75F94C1320D34D59B9700F451CB672123C63DD878F8AE02655FB6390436EDAA
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral10 behavioral9
- Target
  Phantom-main/Phantom/Properties/Resources.resx
- Size 5KB
- SHA256 66b5ebd1b0fc73f041ba669ce2184f6f471d5e3524efa34ca31233e9f5395262
- MD5 0cd8c971317d19bbed44757809bcb92b
- SHA1 47b15748ecc8e952c5935170090db7c269ce4b4f
- SHA512 883dba84bf7daae3ea49f9d54c13dda4f125da82ba63f90eeba0900602896ad9492a0adf7b69b67d838034090af20926af5c2934797afaadb38aa069786c1fc6
- SSDEEP 96:fijrkiK5k5LPXbac9m5Lv6FzSvd4gIRjETUT200qSdvabvDIwQBugqvA:KjrbLPD9sLvIzSvKgIqUEa2
- TLSH
  T17FC11245B1C09D220BF3482DE6527988F7A8923B0235AC54B4DCA61F5F73C85A7B33B6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral11 behavioral12
- Target
  Phantom-main/Phantom/Resources/AESStub.ps1
- Size 1KB
- SHA256 8ecc8244bb15c59e89e3a3a2326fb2ae92816fe3201ed904a3bb2d892b9c970d
- MD5 ba2f921c5680bac542e2d7baa49084f8
- SHA1 69714c121be7649ae3781e93a3b871db54233f7f
- SHA512 2f8f4a2d26f377d8c494907ae006771395bcc21a18f44873b431752c8f61d79e0661d318deccf25276db02f26f117b894b75eff426d030d342e2cf586be7c142
- TLSH
  T1B331EE3C3513A6E896CA6CBA0C3F924A8F280202B219CD45FBCDD645967D9B417B11DE
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  Phantom-main/Phantom/Resources/Stub.cs
- Size 10KB
- SHA256 72fe623abff74a874fbe59803bffd0bb3a480ef27300809e0b7613a5e2b2f9d7
- MD5 c460169f89a7cd024ccd7e837af97dc5
- SHA1 b1cda658ee41289e191fe93fb9bfba45755108fe
- SHA512 f1ae167996fb2d08655aca608b45a0a599c95c01a5f57ffd2e843b839818877e64bdf79f425dfd20addf75b9db5b56e52b16331d93a988bdb0ab0c9e334adae4
- SSDEEP 96:JoOUwX11c6zyVF9vwcdMwkkwaFDEDLqdYJEFH1S86jHB4xkgLaGc6jK0lidP+rBh:K7MwGaRLHkzjhABa4j3qQIi5KLV/Xqp
- TLSH
  T1092273592815A77A48F3222ECF668609FF37122726F24A64BADD81406F7806583B4FE5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  Phantom-main/Phantom/Resources/UAC.dll
- Size 259KB
- SHA256 2907480701d5cd8b3f1577165d59c6321dd172ad6e18e96ecc7b95c67e4e450d
- MD5 40ecf3b9627783b858f342b765f91780
- SHA1 91f073a86e47fd09c27b856b975f1ce4df9e6646
- SHA512 fa76cf04b10cc1565362cf8d052c170f9c1ff62bc78d6c1bb96ad335ef438f113ad65bac7602017ca446fa19066c6ec6dafe2e64a3224373c2e8d8ad6c1d14a6
- SSDEEP 6144:ds7Pz6MhtyuqCxevrwP4fJ8JIiI9Npm62mvFsQk3z8:d0q04h8vIjpm6TY8
- TLSH
  T18D449D42B981D0B6C55F00352029D36AAB3E76104791CEEBE7D09CB94E7B3D18A35B7E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
behavioral17 behavioral18
- Target
  Phantom-main/Phantom/Resources/UAC64.dll
- Size 308KB
- SHA256 1abd799ba4bfee25737243568ae048c0b50f1892b41d7e0f7b3c3af8410babde
- MD5 130553ce2e4112cf59f9cfecfb81fe75
- SHA1 0ec3164f9d3ee5baab8e3862e1b499941a072e5c
- SHA512 50b78c5974147aa1c7e9445bc23490e01f1fc9cf7968040ae27216c34b54c09246409bbcf1a1e5e3f25efcb87906a27386175ea6f911a8e87adbb6d3e2781627
- SSDEEP 3072:+5/t0CPqIvxojcC2QYizfp74RRW+72w3jLYRtx4+O2CvvqFyhvIL65Bl0gdB74ip:KtHlojfpZ6T7PYS+6vCFy465n1Wek
- TLSH
  T1C2644A15BA561879D16BC13882534A627AB67CC20731EEFF12D462393F3BBE06A3C754
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
behavioral19 behavioral20
- Target
  Phantom-main/Phantom/Resources/donut.exe
- Size 242KB
- SHA256 ee68d7deb7cefdfca66c078d6036d7aa3aa7afcc62b282999034b4a1faed890d
- MD5 2a516c444620354c81fd32ef1b498d1b
- SHA1 961d3a6a0588e654dd72d00a3331c684cf8e627c
- SHA512 e8e4bc395997eb6e83e147816faf00ae959e091acba6d896b007781bdc9146157d049d958f9ff7b71a746ed681bd4dcca2fd84aac3eb76c4afe41d49e9f7bd2a
- SSDEEP 6144:ZiF3dWaGNQzmzbgONa3sbMMnl6ysB8X7+AAAAAAAAc8:gFdWaGNGGLUWl6JB+A
- TLSH
  T16D347B55B7A510F2E8B38234C951D716FE727C5503709B8F23A81BA6AF632A07D3E790
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  Phantom-main/Phantom/bin/x64/Release/Phantom.exe
- Size 1.6MB
- SHA256 ccfaf90ce7a8a6b43308fa01f200fe041b545e198edacbfeef11c475ddcfd36b
- MD5 8a26090dfa6ba542f8dccb1615928ce0
- SHA1 cc95636bb8e773f9470c49f135d844af6569c3b5
- SHA512 886426a2b0adb1d4f512a8e0c57dc469799056703960f91b3caa06295d529ff0fd1b4696029a19096ab821869d1309aaed088c7e691a03bf6c7fa3d0c99371c4
- SSDEEP 24576:7O00V4h8gtKm7PMWXWArwboKdpyuw5D9wJWopfw+Jwz/S/6R:BIm7P/GoMgt52Wuw+W7SCR
- TLSH
  T16C75DF01B68158B5D06BA1388532E222EB357C6197A0DEDF33D8397A3F377E06A38755
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery donutloader loader
- Detects DonutLoader
  loader
- Family: DonutLoader
  DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
  loader donutloader
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral23 behavioral24
- Target
  Phantom-main/deobfusactor.py
- Size 11KB
- SHA256 ae142a2319c78fe6029e98e961df6bb6d9f907da3c4aff61a322f70fd3ebde7d
- MD5 e1538f8805616f328560718829a528ea
- SHA1 8fa50535e3413e195dc7d7a488220c174490cc8f
- SHA512 88b1feee723947f64c7d69b81afa298b2e53293e8069f53a869acf82025914e5d99dd3089ece6243a0be97803ebd2d1815553d05bb229c987019f270a50d95b1
- SSDEEP 96:P74STPxJY0Rdak5mQvYf6YIDroe7EqJR9eCwbCEn8F+mIdPSmiFuSez5vQwFB2mE:P7FY0IZcrEqJSjy+m+DdoePTQxj
- TLSH
  T10B327223A8A0A5F4C3C7C56D8D69E40183267D27A6056674FACC86D84F9823DE3B19F8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Command and Scripting Interpreter: PowerShell

Command and Scripting Interpreter: PowerShell

Detects DonutLoader

Family: DonutLoader

Contacts third-party web service commonly abused for C2

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26