Extracted

• • Target

    DistribucionesEnelcaJanS.L.PEDIDO456799.vbs

  • Size

    529KB

  • MD5

    3f13eef87515d70fbdfedc6de7b6efc4

  • SHA1

    8d2394c2e4daada6b8d9af1b60d8d11130ac1845

  • SHA256

    a2ef6e1f58a00b5d6523987df95a7ffc052a89470f97cd228a14fbccff113237

  • SHA512

    585541e886e8175def7f0e4d92c2ad39c065f8777a113c8738a2aaade3dc96592572265f1e3511718dcdd0703730d530fa13b88c4773ecd2a2ef181c5886de7a

  • SSDEEP

    6144:o0/75XG/Kk33JliXA0PsaaBBWiQP88BNkmxylnwa4j3Ms/+UrJ/WzukhWwP+m55k:BNU3/G6PQU8/xCnv4Y4lWzCwPHtvP9Dg

  Score

  10^/10

  vipkeyloggerdiscoveryexecutionkeyloggerstealercollection

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2