Extracted

• • Target
    Контракт № 01-2026.vbs
  • Size 5.3MB
  • SHA256 f88d9094a90f7000a3fb2cd7c981e03357ce2b39df9de5ee1d0742e619e3860f
  • MD5 2ec5a4d805472352a10492d311a80fa7
  • SHA1 da190ccb0e6cdb6b55f40532a0ee7064d31ba760
  • SHA512 4d6c96d139a880020d7afafdf4d6cd2a989bc384d1fdbcf1014b2ea7f349a138edaa86a26c3544ffdbb5e77299e9d06117821a066a0446b05c919ab6b7864d79
  • SSDEEP 24576:QYuC2NrO/LXTGqatNo3sk/mUjIo/f8YpQneRZQ5msYFFXNBYWuXT1I365ZaL47Hn:75J0r+D93O
  • TLSH
    T171469F606E5859F5EF8C690E90AEAF1D83F042176A33706BFB41DF05BDDA241864B21F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondefense_evasiondiscoveryexecutiondonutloadervipkeyloggerkeyloggerloaderpersistencestealer

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Executes a VBScript file via the Windows Script Host.

    execution
  behavioral1behavioral2