General
- Target 2e4c3b553fe7846e9985c6b5c3c4cf7e94e3cf23337e049a7cb14c1c15b8943d
- Size 5.4MB
- Sample261030-rs34razw5m
- SHA256 2e4c3b553fe7846e9985c6b5c3c4cf7e94e3cf23337e049a7cb14c1c15b8943d
Score
10/10
Malware Config
Targets
-
- Target Doc/P775858_QUOTE_OF_PURCHASE_9902884901929.js
- Size 12.0MB
- SHA256 024cd54ca64d10201f2db8dd94d628a921f37df51a530eeba6c0d4224c17b447
Score7/10Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE
Registers new Windows logon scripts automatically executed at logon.
-
- Target Doc/P775858_REF-ITEMS_FOR_ORDER_9902884901928.js
- Size 7.4MB
- SHA256 52cf949bfbe23d5b4efbee0f9b734f426fb43b69078748b7b42c35374ff5dbf8
Score10/10Detects DonutLoader
Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE
Loads dropped DLL
Registers new Windows logon scripts automatically executed at logon.