donutloader

Sharing

Copy URL Twitter E-mail

General

Target
stealabrainrotscripts-tech (infected).7z
Size 2.3MB
Sample260213-hltr3aex7f
SHA256 9ab30291cc33f5f4f52d2c45fcdb50e8dd74d1fb75bc482fb7d0c84b04c78321
MD5 70582e56852b5a43bc51574e3c7b1a4f
SHA1 c961714643b02deacf8f7a88f7ab089e1c605acc
SHA512 557cc69f7385a4ac7aec9fbfec08eb43a1fc6a6b2df4a79f930eb49c6c044f2f44b68d97dcd9450a27992edec9d5ec8367ba1836e065e9bafc84e6c31013cf1d
SSDEEP 49152:wB78e35E46Y5lYy4+9xisYKWz6i1Yeuil56faca7MTBecq4:wB7p6zwICiyerIgMQY
TLSH
T165B5339C1F528AB6C7E12B5BC6934C39CD4FE9855CCB8B8CE1280DD74060A3ABD65DC9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

quasar

Attributes

encryption_key
7E14CE629DFF54A5B6A7B65ECDFE3F45E17BB135
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
reconnect_delay
300
startup_key
"$�/[��+�t�8]l�

Extracted

Family

xworm

Version

91.92.243.10:1234

Mutex

22tybaerN5gt20B6

Attributes

install_file
USB.exe

aes.plain

Targets

- Target
  stealabrainrotscripts-tech/CSGO-main/payload32432432.bat
- Size 519KB
- SHA256 7e4d2347952e195dc974bf518e1282a146d54e0c894ee8fb656190f58b8150df
- MD5 8ea71fce873f7a8ea9840969e3d5e83d
- SHA1 fe5374a2a56c176e6227519d3266839cb61ea686
- SHA512 14a348be9e4cc9066003e0b5020cf1ad341a8dc795d563564d010b727a2c2e15dbff06e92febde704baad65f7defc8da4c03ef1c4126a103566c08e3606fbb8f
- SSDEEP 12288:nYXw/vFY5sr9TQoIliaCmzOWqR/j4siZ9K1o:S6vF/9cZAmzn3sij5
- TLSH
  T10EB402199AE04F7DCEB40B4878F9294F03A085CA127656CFFFABED466BDD598006709C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution quasar persistence spyware trojan
- Quasar RAT
  Quasar is an open source Remote Access Tool.
  trojan spyware quasar
- Quasar family
  quasar
- Quasar payload
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell to get system information as a root user.
  execution
- Executes dropped EXE
behavioral1
- Target
  stealabrainrotscripts-tech/DiscordBot-main/DiscordBot.bat
- Size 519KB
- SHA256 7e4d2347952e195dc974bf518e1282a146d54e0c894ee8fb656190f58b8150df
- MD5 8ea71fce873f7a8ea9840969e3d5e83d
- SHA1 fe5374a2a56c176e6227519d3266839cb61ea686
- SHA512 14a348be9e4cc9066003e0b5020cf1ad341a8dc795d563564d010b727a2c2e15dbff06e92febde704baad65f7defc8da4c03ef1c4126a103566c08e3606fbb8f
- SSDEEP 12288:nYXw/vFY5sr9TQoIliaCmzOWqR/j4siZ9K1o:S6vF/9cZAmzn3sij5
- TLSH
  T10EB402199AE04F7DCEB40B4878F9294F03A085CA127656CFFFABED466BDD598006709C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution quasar persistence spyware trojan
- Quasar RAT
  Quasar is an open source Remote Access Tool.
  trojan spyware quasar
- Quasar family
  quasar
- Quasar payload
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell to get system information as a root user.
  execution
- Executes dropped EXE
behavioral2
- Target
  stealabrainrotscripts-tech/FalconKnife-main/payload2.bat
- Size 527KB
- SHA256 0a1a4da616ed6c20fea8735f2136045e02c7191b2ef8c87cc4fc29852094f6af
- MD5 56e122f5e8acd4849f987adc4a5a9fa8
- SHA1 67bec4950c1eec380416c8abf637bb41c4e07bd8
- SHA512 2e1823c9e45ada5d8d2aaaf81d4eac3b784526b7fe1586ee9048fe787069121e6a85abb39cb5724230936976456ff5ed2dcea4dde627daffb1722d5efc0075d3
- SSDEEP 12288:PjGd1bGDqzBgHTHejpYEErG4/nTM5sLFL:Pj+MWureq0WFL
- TLSH
  T19AB4011EDFE50FA9CEF05A58387A2D4A03A092C6137656CEEF669C032FDB559017B09C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution xworm persistence rat trojan
- Detect Xworm Payload
- Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- Xworm family
  xworm
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell to get system information as a root user.
  execution
- Executes dropped EXE
behavioral3
- Target
  stealabrainrotscripts-tech/FlashTP-main/FlashTP.bat
- Size 498KB
- SHA256 6d17f0b99d5d0534e6bc16b7020d2ab92fe03d6de4db592baa8366a9e56481b5
- MD5 d4d4f04da2377a26fb803dacc163b55c
- SHA1 c75245a0ca4ce20c5dce7335e92326eae2c45358
- SHA512 71b6739ea0dc428509fa0aef7943af40f05d3e96540e300ff14c3dcd1fdf61912e9282cfefc5a8009f51f0984dc3b53ac77369ec0d99f7bec0582c6e3552828c
- SSDEEP 6144:HMT7ILtzsbCX1JWydaH3Hantw82b1wntRti9ZJHBqm5sNzzgie2sI+6yT6d3g5Ci:HhzwC/WyMq2fZwtLKZDq8isTq3nfRY
- TLSH
  T1B1B402165EF44F3BCDB05F48647A3E4B03A696CA02325A4EEF1A9F475BDD849006B0ED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution quasar persistence spyware trojan
- Quasar RAT
  Quasar is an open source Remote Access Tool.
  trojan spyware quasar
- Quasar family
  quasar
- Quasar payload
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell to get system information as a root user.
  execution
- Executes dropped EXE
behavioral4
- Target
  stealabrainrotscripts-tech/Telegram-CasinoBot-main/Discord.bat
- Size 655KB
- SHA256 57ba3b2866836665e5904cb8a235df908fb8b3937e83e3a2daa68ecea7d7267f
- MD5 8b62cd887b7a26ec8a9d513dc0ed9787
- SHA1 23b5b64eded2b97dc8872f9a1bc065229a350637
- SHA512 83d8aea7c6031f9c02ccad1d1639a36f29ce2a42e3370f130b93fae36dc5851690688ba7d17f3e797c06e52fabe49595254a5627ed38fcee12cdf7bc3db44483
- SSDEEP 12288:/iO1ES6kPaR805PYzgF0ZsCLgiQZBZOFi:/3Gxt5QEUxMR
- TLSH
  T11EE4021DAAE50FBACEB41E0878762D4B03A0C2C7013665CFEF6F9D066FD9945156B0AC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution quasar persistence spyware trojan
- Quasar RAT
  Quasar is an open source Remote Access Tool.
  trojan spyware quasar
- Quasar family
  quasar
- Quasar payload
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell to get system information as a root user.
  execution
- Executes dropped EXE
behavioral5
- Target
  stealabrainrotscripts-tech/admin-panel-main/adminpanel.bat
- Size 3.6MB
- SHA256 dcf420c6f330197301d38aa3eeb345bb81862edb740d2b580aca28b882423532
- MD5 b089dd6d865c5ceedc3d6f5f95f58522
- SHA1 a7df32312bb912dbef6bf4e4115cf2511ea51a85
- SHA512 781aba464319d8d6749214972d245c95f29b0a84c2efabafb83f64825f33d62d519f5a2c7fb5af5aa1179c70634de71ffc26d39cecfbf9251087cace4cd359af
- SSDEEP 24576:D0Rtg89XycaGuiSKrr2MiUOqxbnwx+0Y5ZEcSH02bYolMsCEO7fgH3GoZjUgY51a:1JMZff2tCGF+g
- TLSH
  T19E06BEF33495B994CDEEE65F865F8738732A1282B713118D179F0E948B2390F7B8458A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution donutloader quasar loader persistence spyware trojan
- Detects DonutLoader
  loader
- DonutLoader
  DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
  loader donutloader
- Donutloader family
  donutloader
- Quasar RAT
  Quasar is an open source Remote Access Tool.
  trojan spyware quasar
- Quasar family
  quasar
- Quasar payload
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Adds Run key to start application
  persistence
behavioral6
- Target
  stealabrainrotscripts-tech/admin-panel-main/s.bat
- Size 3.6MB
- SHA256 dcf420c6f330197301d38aa3eeb345bb81862edb740d2b580aca28b882423532
- MD5 b089dd6d865c5ceedc3d6f5f95f58522
- SHA1 a7df32312bb912dbef6bf4e4115cf2511ea51a85
- SHA512 781aba464319d8d6749214972d245c95f29b0a84c2efabafb83f64825f33d62d519f5a2c7fb5af5aa1179c70634de71ffc26d39cecfbf9251087cace4cd359af
- SSDEEP 24576:D0Rtg89XycaGuiSKrr2MiUOqxbnwx+0Y5ZEcSH02bYolMsCEO7fgH3GoZjUgY51a:1JMZff2tCGF+g
- TLSH
  T19E06BEF33495B994CDEEE65F865F8738732A1282B713118D179F0E948B2390F7B8458A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution donutloader quasar loader persistence spyware trojan
- Detects DonutLoader
  loader
- DonutLoader
  DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
  loader donutloader
- Donutloader family
  donutloader
- Quasar RAT
  Quasar is an open source Remote Access Tool.
  trojan spyware quasar
- Quasar family
  quasar
- Quasar payload
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Adds Run key to start application
  persistence
behavioral7

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Ignore Process Interrupts

T1564.011

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Quasar RAT

Quasar family

Quasar payload

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Executes dropped EXE

Quasar RAT

Quasar family

Quasar payload

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Executes dropped EXE

Detect Xworm Payload

Xworm

Xworm family

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Executes dropped EXE

Quasar RAT

Quasar family

Quasar payload

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Executes dropped EXE

Quasar RAT

Quasar family

Quasar payload

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Executes dropped EXE

Detects DonutLoader

Donutloader family

Quasar RAT

Quasar family

Quasar payload

Command and Scripting Interpreter: PowerShell

Adds Run key to start application

Detects DonutLoader

DonutLoader

Donutloader family

Quasar RAT

Quasar family

Quasar payload

Command and Scripting Interpreter: PowerShell

Adds Run key to start application

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7