Extracted

Extracted

• • Target

    Inquiry HA-22-28199 22-077.vbs

  • Size

    12KB

  • MD5

    605abed3e1d7266ea35c8517b5961010

  • SHA1

    4c35a1a9e7385b8216812f3c6ff73b23b1710d18

  • SHA256

    394ce0420dc3786db150a630ceb90bac466bf4a3c3f1f792441fed6fb0b6dc34

  • SHA512

    15ff74ef09974c51a36cd4197c45c3391dd76317c2d278a34c9df5adf3cbee41f6fc9cf25450d73f3e6f4e63f00c0e65d874f6b572421bf49611544d11467bbc

  • SSDEEP

    192:bWyKzktunJRUyKzktJDlvgia0GONzU09iT0yFnVk03u3A/WeFW9tWHaFi:Cy44unfUy44dPlzNiKeFsin

  Score

  10^/10

  executionvipkeyloggercollectiondiscoverykeyloggerstealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2