Extracted

• • Target

    QuartoProyectosS.LLISTADECOMPRAS.vbs

  • Size

    25KB

  • MD5

    ca083dbfc2070c0b62a0ec8fa3bd640c

  • SHA1

    779bdfe5ffeaced9821650e6d705fd62b3fd2306

  • SHA256

    4954ea878148cb17c83c6153b3ec49717bbc0413b9cbbf5dca627a3cd7b66128

  • SHA512

    737653fbf8731c35c754f5a8be9248806e2685c34b256bb389b8683b92587a1bf0abe94f23b8b617fa541d613b366c5c553f2fc09bc96fd92253f3ee51d1f33f

  • SSDEEP

    384:4Md+TuIVsrW8EBL1ncevsHkMKeXQyv1Xrxi4j:4s+CIVAWRl1nR6PvJrx5j

  Score

  10^/10

  executionvipkeyloggercollectiondiscoverykeyloggerstealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2