Extracted

• • Target
    REMMITTANCE RETR SCS2208023.vbs
  • Size 5.2MB
  • SHA256 96b747a94a2007c42913189440a8a3014f574d134148017cb2cebef4c66520ca
  • MD5 403703d0c7857a87c6b3dc7021c03494
  • SHA1 090f00a61ea249d80e052813ab9a945eae2683d4
  • SHA512 4c01e2a207b0d39df925f377ac75cff491ecb02d6fca54fc17e1c747916d6760b8026d054507aa6716c57149cc71477acf48c6f9e7202eeb4a61e92c563f1445
  • SSDEEP 24576:8JWJZFOgt5F22LKV/5GyXh5JI7MOK0XiENyHeX4kqN09u2TXzVpeO9765ZaL47HI:CzH+D931
  • TLSH
    T131469F606E5859F5EF8C290E90AE6F1D87F082176A33706BFB41DF05BDDA241864B21F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondefense_evasiondiscoveryexecutiondonutloadervipkeyloggerkeyloggerloaderpersistencestealer

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Executes a VBScript file via the Windows Script Host.

    execution
  behavioral1behavioral2