Extracted

Extracted

• • Target

    Scan12112024,pdf.vbs

  • Size

    11KB

  • MD5

    3f17db10010a4ce43a4f0429179c9f55

  • SHA1

    0a562aa4ba586163f1016b68e028a77bce000490

  • SHA256

    025945e88ff07b6cac99091ea9410351047fa352f29026d5751dc15b63ad1765

  • SHA512

    091d320806d48cf57e00ae906756a351405335d594783f3672746f741ca2f650b097c2a5b8970899d8519b6fd4c7331c9296a815c7c481b7257ef39ae92de004

  • SSDEEP

    192:8ZRtanUEczOg4ya+7ZKQGd6csBGXSqKRq5O09NhN:y0nUcL6LK

  Score

  10^/10

  executionvipkeyloggercollectiondiscoverykeyloggerstealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2