Extracted

Extracted

• • Target

    76cef289abc1b016df678ab28308da2373708a45d99528346409fcb809c813a2.vbs

  • Size

    12KB

  • MD5

    8a330624d5189d9bcd491d93c29624c4

  • SHA1

    b89dd3334cd355360ae7e6f85a060dbe4de9d01d

  • SHA256

    76cef289abc1b016df678ab28308da2373708a45d99528346409fcb809c813a2

  • SHA512

    9af32c229db64bb133a39e7e3ec12dd269d971734fe2e46c61c0167696d6dc43c7ad274e7cbbcb0c41ac529a3ccdbb2a6e04ee1807cdfbe1dd3af11462016685

  • SSDEEP

    96:khBZNNgct8LOgrf8x/JIcBkiYM1z9jRFtRQLNkOAhqL5s7n1muCweU:YBZNUOgrf6/JIcBkiYM1zbuLi7Aub

  Score

  10^/10

  executionvipkeyloggercollectiondiscoverykeyloggerstealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2