Extracted

• • Target

    att1-241104022450_PDF.vbs

  • Size

    28KB

  • MD5

    9d2f1b9d85e014524c2c596d60b0e4c7

  • SHA1

    9c4798635e685841ea77bf887cbb32bb200a0cdd

  • SHA256

    6819ede9fdd746e4b94b591ebd20904bbb0b065c2a20e3f606951147c04e77e5

  • SHA512

    e7cb5b13550925d4a4dee3e1fe6564f7e57f79a457921c46158515e242fa5dbacab75614cb1906ec594bc5fa5b8ef3b7da51f936abe52d6f040051e953a153ca

  • SSDEEP

    768:TODAJEvQefRV0/9QPrhPg691+xggNK5Is:8jvNZV0arV7H+xJNK5Is

  Score

  10^/10

  executionvipkeyloggercollectiondiscoverykeyloggerstealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2