Extracted

• • Target
    9a530341af92669902cca98b4157f04330a66900a375da49210ecc7799fb4bfe.vbs
  • Size 94KB
  • SHA256 9a530341af92669902cca98b4157f04330a66900a375da49210ecc7799fb4bfe
  • MD5 8e82b0e485b5fd9cdf6d921a33cc5bef
  • SHA1 5b7fcef7c553df11e36b96083429346d3a69df7c
  • SHA512 8600e4ecacc3207743661fa31dc7a203f2247a03e20ed63773db43689ad64350b7b24f635c38aa9ef5b245b013d9aa1668a2d632ce1e47a3cd821db62296d501
  • SSDEEP 1536:QKesFjcAgcPs2Ty/kd+vKaQw1LQBvnjW8dx11Vn/0F0Gt6gv1rJ2w:teWcATikdgK01iPjW8dPn/I02pJ2w
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  vipkeyloggerdiscoveryexecutionkeyloggerstealercollection

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Network Service Discovery

    Attempt to gather information on host's network.

    discovery

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2