Extracted

• • Target

    367cfe5599be9a9f9662b61e29c677fbdbc1fc778787025f4231f9a9bbc0f2bb.vbs

  • Size

    67KB

  • MD5

    7c451d0c00a9b2ff5dc980e0190241f8

  • SHA1

    d4bfc47c9a374cd30161a892f9993914a8d56966

  • SHA256

    367cfe5599be9a9f9662b61e29c677fbdbc1fc778787025f4231f9a9bbc0f2bb

  • SHA512

    1625e30a5e3d7190adcf3f293131009eab7a59650c835e27f5ce8c45c2cc4321c69c962c3885a43c498a7a12367cb399a07f2f44490b7f7a383ba66efab1620b

  • SSDEEP

    1536:Gr5Ef9Zo2hIRfVqczWm/T31gtafRiys0VhyCLbkxj:Ga9jhI7qczWw16afAys0Vhxcxj

  Score

  10^/10

  executionvipkeyloggercollectiondiscoverykeyloggerpersistencestealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2