Extracted

Extracted

• • Target

    Payment_Advice.pdf.bat

  • Size

    7KB

  • MD5

    21f91634f445a50f35c006b0c020d0e5

  • SHA1

    64515fa088794b3a62d9863a923b0826e55fecdc

  • SHA256

    b86eb964387f5ed092dad608dd90e9db78fc16d813e6c0720ef409ff458df8d6

  • SHA512

    cd85d95ffac19c47fd06ccc3ac21e6fa4448237572db89d95d0d4f880ef52661998743bb6a152727cf28e472becebc314e62f3f92aad4b5bd5aa885ca6662555

  • SSDEEP

    192:83QlNCq7EH9QUjeYtgpcWOUSNAx21W9v7iBLzP3:4oNCqQ9XqYt2SNe214OJzP

  Score

  10^/10

  executionvipkeyloggercollectiondiscoverykeyloggerstealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Accesses Microsoft Outlook profiles

    collection

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2