Extracted

• • Target

    fa9fa45970a828fe3a99bbe58b142b61c17be373b2652270aee5e16897825654.vbs

  • Size

    339KB

  • MD5

    9dc9a0c38423e7bc364522e158e537ce

  • SHA1

    a005803a54f57739424590995f522f45cbbb6f91

  • SHA256

    fa9fa45970a828fe3a99bbe58b142b61c17be373b2652270aee5e16897825654

  • SHA512

    cbc14b6b980011cca9674f0ce9b94cbb3557d89c2d19784002b33c47428c20bc4c3eb80d0b15443b957d5eb98a3c8daacdb17f4b4ac5e8389c0a1568aa6577c5

  • SSDEEP

    6144:En64ik47Q3WAFLOgL6hPnAIjxnH7sjS3xcrl0ZIRN2XrwozRMeqzAv+qmXpiEcIK:ZgcgL8jD/wGmzcspqd+orNaC

  Score

  10^/10

  executionvipkeyloggercollectiondiscoverykeyloggerstealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2