Extracted

• • Target

    1efb8676f8d9d101a92a618fed06d4a4b53fcd459b7dbcdbf34d4ebb5f9fd180.vbs

  • Size

    339KB

  • MD5

    7a856cb44c862ebc8a1b323b1d72e754

  • SHA1

    792a1beaabdfa91cda63d76196864dbc4ae16cee

  • SHA256

    1efb8676f8d9d101a92a618fed06d4a4b53fcd459b7dbcdbf34d4ebb5f9fd180

  • SHA512

    cb25f3d8e57231fd7697b5684be6831efedf12ed87f24476d9c7919f2c7fb54eafd3662eed2fd05165d64ddda42e510c36c1ac85dd523e1c1b0d68650a0f6f24

  • SSDEEP

    6144:En64ik47Q3WAFLOgL6hPnAIjxnH7sjS3xcrl0ZIRN2XrwozRMeqzAv+qmXpiEcIq:ZgcgL8jD/wGmzcspquhK0k

  Score

  10^/10

  executionvipkeyloggercollectiondiscoverykeyloggerstealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2