Extracted

• • Target

    SUPER ROYAL SEAFOODS RFQ4252394 TIGER BRAND COOKED PEELED SHRIMPS.vbs

  • Size

    97KB

  • MD5

    e87c0eb3faf117b1da8da391eeda594d

  • SHA1

    882f81e1affeef2a61514531a2530744db0e3057

  • SHA256

    c23ce63e10c0e2830f689131779734a7664869c1387dc8809eee9505ee42770c

  • SHA512

    3d6d6a83eea102614a55d2532e08374239c95a07d16ecf4ffbf7ff6c4fe14b53954240a92b2c64d5c4d004e05ca1191a1ba6ed2d6519f1b1be9e151837c2b463

  • SSDEEP

    1536:Q3GsFjLC4sU81EiZ4vDJKIjLLfzXnsfTMGzr0HBEdD5X6/ozz:wGWLjkEi2vDbjXbsfTlHsyDYiz

  Score

  10^/10

  vipkeyloggerdiscoveryexecutionkeyloggerstealercollection

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Network Service Discovery

    Attempt to gather information on host's network.

    discovery

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2