donutloader

General

Target
E-sign Payment confirmation and Agreement.vbs
Size 1.5MB
Sample260218-legqpsez8d
SHA256 c3a1146bf6e791105fdbd64cc28f99a7ff82f356ff8c5c155755bdc0b549c826
MD5 66e7a3b0a4e9acb6340d9cab0e1ac5a3
SHA1 84db78f6af0e919d1456cb17c1759588bd546bff
SHA512 2188acbc99b5bdd44f9a3e11504814b1848c2a1766a8f890c1cd8c31e83ae1490dab0f2cdd259e8b7f3b7b87694b977a81510857e256cf9d28b5a66d2f1832fd
SSDEEP 24576:MudUOW7qRmyemfXBTAxvguObSl6GQkn11s50055n4c2B6:Mui7qbheG5kQBpF
TLSH
T1FE751271867BBEBF09686D8A54133EC11C3CA3A3844CD1B3F6C569BBB2A55D0CD09A64
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

quasar

Attributes

encryption_key
2B0805F4D2EF415F2B88DDF77A6C83D5F5D0D7AF
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
reconnect_delay
3000

Targets

- Target
  E-sign Payment confirmation and Agreement.vbs
- Size 1.5MB
- SHA256 c3a1146bf6e791105fdbd64cc28f99a7ff82f356ff8c5c155755bdc0b549c826
- MD5 66e7a3b0a4e9acb6340d9cab0e1ac5a3
- SHA1 84db78f6af0e919d1456cb17c1759588bd546bff
- SHA512 2188acbc99b5bdd44f9a3e11504814b1848c2a1766a8f890c1cd8c31e83ae1490dab0f2cdd259e8b7f3b7b87694b977a81510857e256cf9d28b5a66d2f1832fd
- SSDEEP 24576:MudUOW7qRmyemfXBTAxvguObSl6GQkn11s50055n4c2B6:Mui7qbheG5kQBpF
- TLSH
  T1FE751271867BBEBF09686D8A54133EC11C3CA3A3844CD1B3F6C569BBB2A55D0CD09A64
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

donutloader quasar loader spyware trojan
- Detects DonutLoader
  loader
- DonutLoader
  DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
  loader donutloader
- Donutloader family
  donutloader
- Quasar RAT
  Quasar is an open source Remote Access Tool.
  trojan spyware quasar
- Quasar family
  quasar
- Quasar payload
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detects DonutLoader

Donutloader family

Quasar RAT

Quasar family

Quasar payload

Checks computer location settings

Executes dropped EXE

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2