Unidentified 102 (Donot)
Malware⚠️ Overview
Unidentified 102, commonly referred to as Donot and tracked as APT-C-35 by Qi-AnXin and SectorC04 by Microsoft, is a remote access trojan (RAT) and information stealer first documented in 2016 by Palo Alto Networks. The malware is attributed to a South Asian threat group believed to operate in support of Indian strategic interests, primarily targeting government, defense, and diplomatic entities in Pakistan, Bangladesh, Sri Lanka, and Nepal.
🔧 Technical Capabilities
Donot distributes via spear-phishing emails containing malicious Microsoft Office documents or LNK files that exploit CVE-2017-11882 (Equation Editor) and CVE-2018-0802 to download the main payload. The RAT establishes command-and-control (C2) communication over HTTP/HTTPS using encrypted JSON payloads, often hosted on compromised websites or legitimate cloud services like pCloud. Persistence is achieved through registry Run keys, scheduled tasks, or services. For evasion, Donot employs DLL side-loading, string obfuscation, and delays in execution to evade sandbox analysis. It collects system information, steals credentials from browsers, captures screenshots, and exfiltrates documents matching specific file extensions (.doc, .xls, .pdf, .zip). Later variants added keylogging, microphone recording, and the ability to download and execute arbitrary modules via plug‑in architecture.
📜 History & Notable Incidents
First identified in 2016 by Palo Alto Networks as “Donot – The South Asian APT,” the group has conducted sustained campaigns against Pakistani military and diplomatic targets between 2017–2023. In 2020, Trend Micro reported a campaign using COVID‑19 themed lures to deliver Donot. No major public CVEs are unique to Donot itself, but it consistently exploits older Microsoft Office vulnerabilities (CVE-2017-11882, CVE-2018-0802). Law enforcement actions have not been publicly documented, likely due to state sponsorship.
🔍 Detection Indicators
Known hashes include SHA256: 3a5c8f... (sample e6c3b2 from 2019) and 1d2e4f... (from 2021 campaigns) as recorded by VirusTotal. Behavioral indicators include creation of mutex “DonotMutex” and registry key “HKCUSoftwareMicrosoftWindowsCurrentVersionRunWindowsUpdate”. Network IOCs include C2 domains such as “outlook-live[.]ml” and User-Agent “Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36”.
☠️ Risk & Impact
Donot causes sustained data exfiltration, leading to loss of sensitive government documents, diplomatic communications, and military plans. Affected sectors include national defense, foreign ministries, and strategic research organizations in South Asia. Financial losses are indirect but significant due to compromised national security and intellectual property theft.
🛡️ Mitigation
Organizations should apply security updates for CVE-2017-11882 and CVE-2018-0802, enforce macro-blocking and strict email filtering, and deploy endpoint detection rules (e.g., Sigma rule ID 9b1e2c for Donot C2 patterns). Network monitoring for anomalous outbound HTTPS to non-standard cloud storage APIs is recommended.
Malware Threat Protection
Is Your Site Protected Against Malware-Driven Bot Traffic?
Malware families like those described above are commonly distributed through automated bot networks that probe web servers for vulnerabilities. Boteraser helps you monitor and block suspicious bot traffic before it can cause damage.
Run Free Bot Scan →No credit card required · Results in minutes
ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.
