Extracted

• • Target

    Permintaan Untuk Sebutharga RFQ 087624_Pdf.vbs

  • Size

    29KB

  • MD5

    e1e5a3c6c5cba2a431c6c7b970486c1a

  • SHA1

    adb2d67c153f9ffe56315d6eac2de6adcf2c7a87

  • SHA256

    3e3da0990a7a0ec7287bede75ea413d4beb4c0d0dc5fcd04ae37ee1129f6b46d

  • SHA512

    801640e3674bef81f05f9b7b7dd03ac3d4a52a1eec909221240ebe5fec783c3b33001fd217fb1b2e02e0895075cea7f483a0d1b82d189f39a14929bb1b0d606b

  • SSDEEP

    384:Y2kDRQGJuHwVQYFup6OtxODqjdugAbl9GPPfjgZrpd:Y2kDRQGrVQ+8PtEGjdugAaPPfq7

  Score

  10^/10

  vipkeyloggercollectiondiscoverykeyloggerstealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2