Extracted

• • Target
    3a5522c01ac82f82a1106026e39a798bb9fa404a132fe55417279ba456ecec57.bin
  • Size 10.0MB
  • SHA256 3a5522c01ac82f82a1106026e39a798bb9fa404a132fe55417279ba456ecec57
  • MD5 8da1d39a7687162fcde70d22a94d3c63
  • SHA1 27164bdf0a9e219c0314ce0e8f0e6d3db43892e1
  • SHA512 2762b67c48ebe6ce7688e12d48221e40233a0de9951076cf6cc6b5c495c019d77a92784705d2cb827e6134c6e440624fab45fe20d40bba7f4a2b3dfc220caeae
  • SSDEEP 98304:OWgSXE3++P74FzSKT6W1Ac2kfvGIcJXossij4ZajoRNxN0wGQ3A83ciYtksL7fAZ:OC28FzSOzYkfOIcJosdTTNUNv
  • TLSH
    T196B67B17FDA149F9D1AAA13189769252BF71BC484B2223D32B64B3382F727D06DF9740
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwareja1donutloaderstealcwarden_stealerloaderpersistencespywarestealer

  • Detects DonutLoader

    loader

  • Detects WardenStealer Rust payload

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Family: WardenStealer

    WardenStealer is a Windows stealer written in Rust.

    stealerwarden_stealer

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1