Extracted

• • Target
    Scan_Doc-PO-07980-PR-069-MQ-06979-2026.bat
  • Size 162KB
  • SHA256 3d1e3cfc07f4abf9eb6c19b18d6f0b95c65e21e1f23b43526078d42bd3d99083
  • MD5 896cc37c17b5afc6dafc3d7d8d8bf9a0
  • SHA1 87f01114d11207de0890939d3cd36b8071456a94
  • SHA512 fdba62b521435fc1ed73b4282c574e072f150f7d22c3b8202f162c1ad9a9ec5ff70fe7da7df9c3ed86c4477480a08f2d2896bdae97693fe9339d2557d95368ec
  • SSDEEP 3072:+3IkArQhfeQpX7o3FolrWwP1Z8xLflojnCes+KCszhf8K:C6UhfeY7omWk+fkDs+KNzhfJ
  • TLSH
    T143F3F11259C83F74CEF55D3C60FE090A77B251DF550AE5CAA723AD09EFA7209002EAD6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasionexecutiondonutloadervipkeyloggerkeyloggerloaderpersistenceprivilege_escalationstealer

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2