Extracted

• • Target

    Request for Quotation MK FMHSRFQ241104.vbs

  • Size

    27KB

  • MD5

    c60635c4c50b8f387ce0e639dd9eaa46

  • SHA1

    5d291ffbe72460f9add7ecfeea6ddda021a6fe06

  • SHA256

    d7d87050073e14ea054e3d2bf7f7b7335a30af2d640b7b9baf87b175a64a4cf2

  • SHA512

    69bf250e11dc07a46c9d889c7c82c5ae2ec7dde671483a9032251d3264a286fe7a1ef381bc645170ae8f846175737c2f03b25a466e32ea15187f566da038865e

  • SSDEEP

    384:7VsZvfnmuB6Z3ncehRM7v4Rk98oBhMWCfyNy19lS:RsFmuB+35E4+TBhnIyNy19lS

  Score

  10^/10

  vipkeyloggercollectiondiscoverykeyloggerstealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2