Extracted

• • Target

    14eb913e7c5fe08f6c5f656178f35713b605f7d0aa1c62489b3cfaf418a0c27e.vbs

  • Size

    334KB

  • MD5

    711cff133683d7f9312c134d52588e61

  • SHA1

    b062c22b25b1bd40ea3cf6353cedcee0d86188ac

  • SHA256

    14eb913e7c5fe08f6c5f656178f35713b605f7d0aa1c62489b3cfaf418a0c27e

  • SHA512

    9faf806f982d1f1ca617ef7c37f06d635a0cdcb50a94b4e5707060af0354a436b0a847681de2f9164a4f79d8e08250d1589da272b975f0a4afa9617918a28a37

  • SSDEEP

    6144:En64ik47Q3WAFLOgL6hPnAIjxnH7sjS3xcrl0ZIRN2XrwozRMeqzAv+qmXpiEcIi:ZgcgL8jD/wGmzcspqAI3Hr

  Score

  10^/10

  vipkeyloggercollectiondiscoverykeyloggerstealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2