Extracted

• • Target

    Pedido de Cotação-24110004.vbs

  • Size

    37KB

  • MD5

    7e19f07f21a6afb866680d0807d48d4e

  • SHA1

    2c966096d44a10645d3459e0305eae59ac2d5675

  • SHA256

    cd561af39d622a0ef38283e51c0e523bf6d607434fea285afbfa9aaf286935e3

  • SHA512

    90ed376cac3575fd99d125c1adbbfbdc1b5fbc406b1e7bfa14c7b831b611d818522410b79f0d430ab18beea0d97527c17bf8de5b8a1ea44687c5b3a7fc8c3b6c

  • SSDEEP

    384:xKH0NCRhivTJLEC8RXFlYV/GBTq02x5ImMAErNDn6:xKH0NewvyFRXFlYVoTq02x5B9Eln6

  Score

  10^/10

  executionvipkeyloggercollectiondiscoverykeyloggerstealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2