Extracted

Extracted

• • Target

    Yeni sipariş _TR-59647-WJO-001.vbs

  • Size

    11KB

  • MD5

    2c6472b80d9ffbbb9a68c8dc0ff6fb19

  • SHA1

    a7c487f72bb59453014912b36610d254452fa87a

  • SHA256

    c35fb5adc491eb8c62504f7d88e8809a7d273b29851a6a66b6155936d07acea3

  • SHA512

    f541e67826d489f8b6694ead8486acbf6dc64fbbf624006404a842549b896a0590170a68dba624fd3c99dfc3772d7390deed23479700e2cb3354e5b20fd054b4

  • SSDEEP

    192:TXHapAOg8/W/MnmbKMpuLMEyTeFQnu3mdOLkL7Fi:TXjU8k3mOkw

  Score

  10^/10

  executionvipkeyloggercollectiondiscoverykeyloggerstealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2