The report describes a multi-stage Windows malware chain that relies on a concealed batch script for persistence, a PowerShell loader, and Donut-generated shellcode to inject a .NET stealer and remote-access toolkit into legitimate processes. The implant supports credential theft, webcam/audio capture, clipboard monitoring, and data exfiltration through Discord webhooks and Telegram bots. Persistence is maintained via per-user Run key entries and scheduled tasks, reinforced by a watchdog that repeatedly re-injects into explorer.exe. Anti-analysis coverage includes anti-VM checks, anti-debugging logic, and safeguards meant to detect process-injection monitoring.
Researchers dissected the batch-based persistence stub, extracted and decoded the embedded Base64 content, and recovered a PowerShell stage responsible for decrypting a Donut shellcode blob. That shellcode loads a heavily obfuscated .NET payload (Client.exe) with modular assemblies such as Pulsar.Common.dll and Stealerv37.dll. Dynamic testing confirmed injection into svchost.exe and explorer.exe, active C2 communications, and memory-resident execution designed to avoid writing a decrypted executable to disk.
Detect and prevent PowerShell abuse involving execution-policy bypass, monitor for hidden-file creation under %APPDATA%, and alert on suspicious modifications to HKCU Run keys. Flag scheduled task creation that uses unusual naming patterns or unexpected triggers. At the network layer, block outbound connectivity to the identified IP address and enforce tight egress controls for Discord and Telegram API traffic. Strengthen defenses with detections for anti-VM/anti-debug behavior and apply application allow-listing to limit script-driven payload staging.
If activity is detected, isolate the endpoint, stop malicious and injected processes, remove the hidden batch artifact and any related PowerShell scripts, and delete the associated Run-key value and scheduled task. Capture memory for forensic analysis, preserve logs for scoping, and hunt for correlated IOCs across the environment. Rotate potentially exposed credentials and monitor for lateral movement or follow-on payload deployment.
Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.
Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.
Attack Narrative & Commands: An adversary has breached a low‑privileged user account and seeks persistence across reboots. To avoid triggering traditional executable‑based defenses, they craft a lightweight batch file ( persistence.bat ) that launches a reverse shell. The attacker writes the batch file to %TEMP% and registers it under the HKLM Run key, ensuring execution under the SYSTEM context at every logon. The chosen .bat extension matches the detection rule’s “.bat” filter, guaranteeing the rule fires.
Regression Test Script:
Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
