Extracted

• • Target
    Request for Quotation (RFQ).hta
  • Size 5.3MB
  • SHA256 ed48e74129c7f946abf72f6a14d4683a69cad54787e91c8a0b84b41b5eedfbd5
  • MD5 da8e26b87e7ab3bbc11d9871cc400627
  • SHA1 eb39e030b6c13c2c8a28e88b75f489b6dc624604
  • SHA512 1fdb5277f5b17276386955eb358fec4761186b9afed91a225cbe6fbb13f3aa69259809f8e08c948a79069dcf7de4bde4226d31fec9014e66a2965959238cc595
  • SSDEEP 24576:FqTdye/nXJYlqjDd+7A5zlQYRxHTkQ/QxrJk+jaDNlJBAR/cq65ZaL47HReAZxVc:k+D93X
  • TLSH
    T1C7469F506E5859F5EF8C290E90AEAF1D87F042176A33706BFB41DF05BEDA241864B21F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiondonutloadervipkeyloggerkeyloggerloaderpersistencestealercollection

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2