Extracted

• • Target
    Agenda de Pagamento outubro 2024.vbe
  • Size 98KB
  • SHA256 41c4718c2c894df5bc4dff1dfb6583dbd3c609f294eae8c97d95e5a79a2b1faf
  • MD5 3314256cdab0b45bb51b688925523352
  • SHA1 473e14cfccdb08ea595aeb5bdd6462981cc3745c
  • SHA512 e12483271bd3156efa15bd459c8547406d26656c1568431e90def47e7081b634997f4c5ed842bcaea56cd91be2d08889ad756adeae6896fc26966322c56b91a1
  • SSDEEP 1536:QlEsFjKtUCsIDJCe19D1EmBeo5IS+XnH5KiLxdtP10Acv6S3DH:oEWK6AtP1F1LVAH5KsvtP+AOD
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  vipkeyloggerdiscoveryexecutionkeyloggerstealercollection

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2