Extracted

• • Target

    RFQ_64182MR_PDF.R00.vbs

  • Size

    525KB

  • MD5

    63a5b7d958f537744c5330b3fef8ccac

  • SHA1

    00ba79f887c403afabdd6ffe21db30e82288f84b

  • SHA256

    ee763e48dad8e005251345990a572ccbf15929e76c5fa68ab3d1fc80ef7e5286

  • SHA512

    3e7dd82783ffc59320bcdef7942d9b2e7de31cb40dd1c7597d5b17895e6c695888b4791b8191f80aedc0f1fe053d05785681844cf1c1cb0d16158411bffd7909

  • SSDEEP

    6144:Zf/7gXsuuCdsOQpE4V+iZeCKnoQLirdqJGfimOWIVV8T6Oj+WqXZQRhmxCDf2Nzv:u66sOQ66MfiZqbm3eVpZxxCTagc7og

  Score

  10^/10

  vipkeyloggerdiscoveryexecutionkeyloggerstealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2