Extracted

Extracted

Extracted

• • Target

    CamScanner 02-13-20251913.js

  • Size

    311KB

  • MD5

    0f46741439a8c946516d94701cf79880

  • SHA1

    87f08d8468836229b17cba9038057c2063a70435

  • SHA256

    033b8f0ed742cf0b279f710c47496a522a338da63d16007395e9d409271ee77e

  • SHA512

    c92e96c6bd661d558a1070a8fc855e418c6ff4decb27f2e52a0069bf02dd76887e7eac1f3a05906693eb25f21fa9d5c13476104bca160ad8290b469a940c4441

  • SSDEEP

    3072:5vJ5HovJ5HovJ5HovJ5H7vJ5HovJ5HovJ5HovJ5H4vJ5HovJ5HovJ5HovJ5H8RTP:6Px1L

  Score

  10^/10

  executionvipkeyloggercollectiondiscoverykeyloggerstealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2