General
- Target malware.zip
- Size 4.1MB
- Sample260423-dhbd4ahv41
- SHA256 85b230f2986b6bfd48ebfc6dc81ab6e546ca93cb081f6bc7a121975999141c1a
Malware Config
Extracted
-
vipkeylogger
-
Protocol
smtp
-
Host
mail.spacaex.com
-
Port
587
-
Username
-
Password
d!+L4UyRYkucBiOJ
-
Email to
Extracted
-
Protocol
smtp
-
Host
mail.spacaex.com
-
Port
587
-
Username
-
Password
d!+L4UyRYkucBiOJ
Extracted
-
Protocol
smtp
-
Host
mail.wwvvinc.com
-
Port
587
-
Username
-
Password
Payday2026
Extracted
-
phantom_stealer
-
v3.5.0
-
Protocol
smtp
-
Host
mail.wwvvinc.com
-
Port
587
-
Username
-
Password
Payday2026
-
Email to
-
PT5POAB7KMMMCPYGQODL
-
anti_analysis
0
-
cb_enables_ssl
0
-
debug
0
-
keylogger
0
-
start_delay
0
-
startup
0
Extracted
-
masslogger
-
exfiltration_mode
#SMTPEnabled
-
expire_time_date
2025-12-17
-
host_password
dy8tm;jRtJO[:bG:
-
host_port
587
- host_receiver
- host_sender
-
host_server
mail.taikei-rmc-co.biz
-
ssl_slate
True
Extracted
-
Protocol
smtp
-
Host
mail.taikei-rmc-co.biz
-
Port
587
-
Username
-
Password
dy8tm;jRtJO[:bG:
Extracted
-
Protocol
smtp
-
Host
mail.taikei-rmc-co.biz
-
Port
587
-
Username
-
Password
e9*w}o;Gm5Zh_2Oc
Extracted
-
Protocol
smtp
-
Host
mail.taikei-rmc-co.biz
-
Port
587
-
Username
Targets
-
- Target ENJOY.ps1
- Size 176KB
- SHA256 e178ec2c637f8340288d0928c5de1a852e5f6fdded6327cfb3fc2c752f0c88cd
Score10/10-
Detects DonutLoader
-
Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
-
Family: VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
- Target Gold.ps1
- Size 106KB
- SHA256 2b9067eeb7909d5e78c83d9a37b379d6531a5b893d5a002b06c4f851edb1f402
Score10/10-
Detects DonutLoader
-
Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
-
Family: MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
- Target Indeed.bat
- Size 1.1MB
- SHA256 6c403ed3119dae79cc5abf671489c6b1053ae5de11d249c74b3a9e9c01d86634
Score10/10-
Detects DonutLoader
-
Detects PhantomStealer written in C#
-
Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
-
Family: PhantomStealer
Phantom Stealer is a stealer written in C#, forked from the Stealerium family.
-
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
- Target Jump.ps1
- Size 820KB
- SHA256 22bdb406f852375a0dec9a309d923d39f3e38f7b465fb51ea0710d70b9eb3ba8
Score10/10-
Detects DonutLoader
-
Detects PhantomStealer written in C#
-
Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
-
Family: PhantomStealer
Phantom Stealer is a stealer written in C#, forked from the Stealerium family.
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
- Target Lunch.ps1
- Size 176KB
- SHA256 5364a6db5cfb43f056be8dd0102124a425bd7b02c406b2f4af822b3e18106144
Score10/10-
Detects DonutLoader
-
Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
-
Family: VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
- Target SIMPLY.ps1
- Size 105KB
- SHA256 43d206a3928e1d6445113250bee9b2f8b0568b062280d28af8b496a5e76d4b78
Score10/10-
Detects DonutLoader
-
Detects SentinelRAT payload
-
Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
-
Family: SentinelRAT
SentinelRAT is a Windows remote access tool written in C#.
-
- Target pace.ps1
- Size 404KB
- SHA256 6a94e0e6917dac14fe32db0e46e328251ca2baa5551712ab5a9b6e008a0ebd6c
Score10/10-
Detects DonutLoader
-
Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
-
Family: VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
- Target rail.ps1
- Size 1020KB
- SHA256 4f7d170b16f656a4bd09f5e1b8606eab8b8a5381a1230e2a716a01cc837c73f6
Score10/10-
Detects DonutLoader
-
Detects PhantomStealer written in C#
-
Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
-
Family: PhantomStealer
Phantom Stealer is a stealer written in C#, forked from the Stealerium family.
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
- Target roughly.ps1
- Size 170KB
- SHA256 7d8cf5a10104f02491f52f8d7314c729d30cdb469f18ff8c2f0766faf11c2c00
Score10/10-
Detects DonutLoader
-
Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
-
Family: MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
- Target sport.ps1
- Size 821KB
- SHA256 0671be8c3c90f4f70b4feef76edbf8f3fd8d8b9ceb191675b100912d70e82c22
Score10/10-
Detects DonutLoader
-
Detects PhantomStealer written in C#
-
Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
-
Family: PhantomStealer
Phantom Stealer is a stealer written in C#, forked from the Stealerium family.
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
1