Extracted

Extracted

• • Target

    QUOTATION REQUIRED_Enatel s.r.l..bat.exe

  • Size

    926KB

  • MD5

    dac368e84e853adec2a5bb1cd87cd1c6

  • SHA1

    139c10cfa59c1e25039c02671010009de25a2690

  • SHA256

    ece7de25d48e50e93d3d60f600a7676fe24a520916844f6826b4837ac8dd7ebc

  • SHA512

    823336a9f2016c7144d863000606e45b839746163d4f921150c283021dd06c6def082b66660888fdc70141b989f9d01f4332d3d626c030c962453c78977fe9ac

  • SSDEEP

    24576:c8yNK1t4NK1tOqLBPitz9yZJLjsqk488RBAUt6a:rhkLyZJLjs74Bv

  Score

  10^/10

  vipkeyloggercollectiondiscoveryexecutionkeyloggerstealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Uses the VBS compiler for execution

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2