Extracted

• • Target
    RFQ no 4000230964.vbs
  • Size 5.3MB
  • SHA256 f25bae99847c5ab9bf1c0e7ea11e27aaa49decacdacbcdbc9e2b1eedb30e10e0
  • MD5 21e2b1f2e81c9cbf5ae9f95c8a75d16d
  • SHA1 ac42ffdc17335221b696cdef5c19f6697bbf3dd1
  • SHA512 b799c5ca9d57ac694fc691c327b64618b2cf5552889f51f3ca2def5bd30c3b82470b63b5ab84177430c1959dbfa02cbac6e74c9a959e87e7c1f8a54db7a17902
  • SSDEEP 24576:JJ85LLIT/ZrUgAXBjFNKbf8vRb3MI9fhlse1CtXmIhtAClHwKvZvHmuuFWdwPjrQ:1mG+D93O
  • TLSH
    T166469F616E5859F5EF8C2A0E90AE6F1D83F042176A33706BFB41DF05BDDA241864B21F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiondonutloadervipkeyloggerkeyloggerloaderpersistencestealercollection

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Executes a VBScript file via the Windows Script Host.

    execution
  behavioral1behavioral2