ScanDonut

Extracts configs and modules from donut payloads

Source code in strelka/src/python/strelka/scanners/scan_donut.py

class ScanDonut(strelka.Scanner):
    """Extracts configs and modules from donut payloads"""

    def scan(self, data, file, options, expire_at):
        tmp_directory = options.get("tmp_directory", "/tmp/")

        with tempfile.NamedTemporaryFile(dir=tmp_directory, mode="wb") as tmp_data:
            tmp_data.write(data)
            tmp_data.flush()
            tmp_data.seek(0)

            try:
                donuts = DonutDecryptor.find_donuts(tmp_data.name)
            except Exception:
                # Set output flag on error
                self.flags.append("donut_decrypt_find_exception")

            self.event["total"] = {"donuts": len(donuts), "files": 0}

            self.event["donuts"] = []

            for donut in donuts:
                donut_data = {}
                donut_data["instance_version"] = donut.instance_version
                donut_data["loader_version"] = donut.loader_version
                donut_data["offset_loader_start"] = donut.offset_loader_start
                donut_data["offsets"] = {}
                donut_data["offsets"]["size_instance"] = donut.offsets.get(
                    "size_instance"
                )
                donut_data["offsets"]["encryption_start"] = donut.offsets.get(
                    "encryption_start"
                )

                self.event["donuts"].append(donut_data)

                try:
                    with tempfile.TemporaryDirectory() as tmpdirname:
                        donut.parse(tmpdirname)

                        # Retrieve module file
                        with open(
                            os.path.join(
                                tmpdirname, f"mod_{os.path.basename(tmp_data.name)}"
                            ),
                            "rb",
                        ) as mod_file:
                            # Send extracted file back to Strelka
                            self.emit_file(mod_file.read())
                            self.event["total"]["files"] += 1

                        # Retrieve instance metadata file
                        with open(
                            os.path.join(
                                tmpdirname, f"inst_{os.path.basename(tmp_data.name)}"
                            ),
                            "rb",
                        ) as inst_file:
                            inst_json = json.load(inst_file)

                            # Remove unneeded File key
                            inst_json.pop("File", None)

                            def change_dict_key(
                                d, old_key, new_key, default_value=None
                            ):
                                d[new_key] = d.pop(old_key, default_value)

                            # Reformat the dictionary keys to be consistent
                            for key in inst_json:
                                change_dict_key(
                                    inst_json, key, key.lower().replace(" ", "_")
                                )

                            # Update the current donut output
                            self.event["donuts"][len(self.event["donuts"]) - 1].update(
                                inst_json
                            )

                except Exception:
                    # Set output flag on error
                    self.flags.append("donut_decrypt_parse_exception")

Features

The features of this scanner are detailed below. These features represent the capabilities and the type of analysis the scanner can perform. This may include support for Indicators of Compromise (IOC), the ability to emit files for further analysis, and the presence of extended documentation for complex analysis techniques.

Feature	Support
IOC Support
Emit Files
Extended Docs
Malware Scanner
Image Thumbnails

Tastes

Strelka's file distribution system assigns scanners to files based on 'flavors' and 'tastes'. Flavors describe the type of file, typically determined by MIME types from libmagic, matches from YARA rules, or characteristics of parent files. Tastes are the criteria used within Strelka to determine which scanners are applied to which files, with positive and negative tastes defining files to be included or excluded respectively.

Source Filetype	Include / Exclude
hacktool_win_shellcode_donut

Scanner Fields

This section provides a list of fields that are extracted from the files processed by this scanner. These fields include the data elements that the scanner extracts from each file, representing the analytical results produced by the scanner. If the test file is missing or cannot be parsed, this section will not contain any data.

Field Name	Field Type
donuts	list
donuts.compression_type	str
donuts.decoy_module	str
donuts.entropy_type	str
donuts.instance_type	str
donuts.instance_version	str
donuts.loader_version	str
donuts.module_type	str
donuts.offset_loader_start	int
donuts.offsets	dict
donuts.offsets.encryption_start	int
donuts.offsets.size_instance	int
elapsed	str
flags	list
total	dict
total.donuts	int
total.files	int

Sample Event

Below is a sample event generated by this scanner, demonstrating the kind of output that can be expected when it processes a file. This sample is derived from a mock scan event configured in the scanner's test file. If no test file is available, this section will not display a sample event.

    test_scan_event = {
        "elapsed": 0.001,
        "flags": [],
        "total": {"donuts": 1, "files": 1},
        "donuts": [
            {
                "compression_type": "DONUT_COMPRESS_NONE",
                "decoy_module": "",
                "entropy_type": "DONUT_ENTROPY_DEFAULT",
                "instance_type": "DONUT_INSTANCE_EMBED",
                "module_type": "DONUT_MODULE_NET_DLL",
                "instance_version": "1.0",
                "loader_version": "1.0_64",
                "offset_loader_start": 10196,
                "offsets": {"size_instance": 4744, "encryption_start": 572},
            }