Executive Summary
A sophisticated phishing campaign targeting Ukrainian users has been identified, utilizing lures like 'Attachments to the order.zip' to deliver a malicious VBScript dropper. The attack chain begins with a ZIP file containing a VBScript disguised as a PDF using the double-extension trick. Once executed, the script performs environmental checks to identify sandboxes before proceeding to its primary objective of staging further malware.
The VBScript acts as a first-stage downloader, reaching out to external hosting services such as Filemail and ImageURLGenerator to fetch a decoy PDF and a second-stage ZIP payload (disguised as Evernote.zip). The attack culminates in the extraction and execution of a bundled binary, often a renamed or repurposed legitimate executable like notepad++.exe, while cleaning up local artifacts to minimize the forensic footprint. The presence of long sleep delays and language-specific social engineering highlights a focus on evasion and persistence.
While the specific final payload remains variable, analysis suggests this infrastructure supports the delivery of various threats including XHOPLESS and OpnKey Ransomware. The campaign's reliance on common file-hosting services and legitimate binaries makes detection challenging for traditional antivirus solutions, emphasizing the need for robust behavioral monitoring and email security.