Extracted

Extracted

• • Target

    31c400430c28c2ca29976d862878eeb2c365ae4f4afc450eaa6459364cac143a.vbs

  • Size

    530KB

  • MD5

    d281f65b5323332d8061568ce377ea0b

  • SHA1

    67230ca5abe0f13217a34801be32ff2d573692fa

  • SHA256

    31c400430c28c2ca29976d862878eeb2c365ae4f4afc450eaa6459364cac143a

  • SHA512

    6a163cb0202bec65ff0d66df700e93ac6c051469a9c5e4d1e68b2be1e7886f70f69a290e8c2b5e39c1d362d2783942c81561685465149cf6ab75c9d606ee2d16

  • SSDEEP

    6144:or/7TXNXM0vl4byj8e8j9317d6AMGsP8lLJIRChb6peTUy6TcWFhyuNgtjzfzycT:iSmlcIyYA/sEJQcb0ctuNOLycdeg

  Score

  10^/10

  vipkeyloggerdiscoveryexecutionkeyloggerstealercollection

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2