Beware of Phishing Emails Disguised as Purchase Orders
Recently, the AhnLab SEcurity intelligence Center (ASEC) identified instances of phishing emails being circulated that disguise themselves as requests to confirm purchase orders. The email body asks recipients to review the attached purchase order and reply with the relevant information, prompting users to download and open the attached DOCX file.
- Attachment: PURCHASED ORDER.Docx
[Figure 1] Phishing email body
The attached DOCX document contains a malicious RTF file named “niza.Rtf,” which loads the “word\niza.Rtf” file through the altChunk element. AltChunk is a WordprocessingML element used in DOCX documents; it allows content in external formats, such as HTML or RTF, to be imported and displayed within the document without being inserted directly into the body XML.
[Figure 2] Malicious RTF file contained within the DOCX file
As shown in [Figure 3], the `niza.Rtf` file contains a malicious VBS file named `832734.Vbs` and an `Equation.3` Object that triggers the Equation Editor vulnerability. The 832734.Vbs file is created in the %TEMP% directory, and the malicious VBS file is executed when the command `cmd.Exe /C cscript %TMP%\832734.Vbs` is run through the Equation Editor vulnerability.
[Figure 3] 832734.Vbs and the exploit code embedded in the RTF file
The 832734.Vbs file creates a %APPDATA%\Tempor.Zip file containing Base64-encoded data and then runs PowerShell in hidden mode. The PowerShell script then reads and decodes the Base64 string from the `Tempor.Zip` file—which is not actually in ZIP format—and saves the decoded data as a ZIP file with an arbitrary GUID name in the `%TEMP%` Path. If the %USERPROFILE%\AppData\Roaming\Templates\python312x86 folder already exists, it deletes and recreates the folder, then decompresses the contents of the temporary ZIP file to that Path. Once the decompression is complete, it deletes the temporary ZIP file and executes the Protected.Py file through pythonw.Exe, located in the python312x86 folder, to carry out subsequent malicious behavior.
[Figure 4] Part of the 832734.Vbs code
[Figure 5] Decoded Tempor.Zip file
Protected.Py Base64-decodes Excepteur.Dal, located in the same Path, and then performs decryption in the following order: Salsa20 → ChaCha20 → RC4 → XOR. The decrypted data contains a PE loader and shellcode; after mapping the loader into memory, it passes the shellcode address to the loader to execute it.
[Figure 6] Part of the Protected.Py code
The shellcode ultimately executes SnakeKeylogger, an Infostealer. Snake Keylogger establishes persistence through the Registry’s Run key and then steals keyboard input, clipboard data, screen captures, Wi-Fi passwords, browser and email account information, FileZilla login credentials, Discord tokens, public IP addresses, and location data.
SnakeKeylogger C2
- Mail Server: cphost17.Qhoster[.]Net:587
- ID: obsender4snake@exzwzc[.]Com
- Email To: kingmethodlogs2026@exzwzc[.]Com
[Figure 7] SnakeKeylogger
Response Guide
1. Verify the Sender
- Verify that the sender’s email address uses an official domain.
2. Check Hyperlinks and Attachments
- If the email prompts you to click on an image attached to the body of the message, check the linked URL first before clicking. Suspicious URLs often lead through non-official pages before finally redirecting to a legitimate page, so you should examine them carefully. Additionally, if there are attachments, check for suspicious file extensions (.Exe, .Vbs, .Js, etc.).
3. Be Cautious When Entering Sensitive Information
- If you are asked to provide sensitive information, such as login credentials, always verify that the page’s URL is that of the official site before entering any information. If the page is not official, it is highly likely to be a suspicious URL, so caution is required. In particular, check the page’s security certification (HTTPS, padlock icon) before entering sensitive information, and never enter any information if you have any doubts.
Gain access to related IOCs and detailed analysis by subscribing to AhnLab TIP. For subscription details, click the banner below.
