Extracted

Extracted

• • Target

    e3dadda28d21c40c06bcfd1163b6b7d170689976d69a66985fa309197fb49850.vbs

  • Size

    12KB

  • MD5

    4e9b8807134dfb560b0eb3f0bf8705af

  • SHA1

    086e955967a78b02bb006f3d2755dfc49c536990

  • SHA256

    e3dadda28d21c40c06bcfd1163b6b7d170689976d69a66985fa309197fb49850

  • SHA512

    62dc169e27636a9baee657969f0e678b582a6a4a4b595fb242b037be53ab70c410c241d2f3c0b22f64c1bf7ad429fabc6f2705042f43f53dabc13d0e1369e99b

  • SSDEEP

    192:spKV/HwG/IUUtbeDQgGHOgy9w3Kjv3H03f7sbcS/7XQx74DGICrZOnips3SkvDA:fV4N//ICrZOnips3Sl

  Score

  10^/10

  executionvipkeyloggercollectiondiscoverykeyloggerstealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2