Extracted

• • Target

    47692eadbf8d27bab81f7c699d31a547d929a014409644a52c3d74e2fc66c7b3.vbs

  • Size

    62KB

  • MD5

    43b0f24b4e0952fa530851797e64d542

  • SHA1

    e84a97f5d1fc38bab6da3d8b8dce4468e9e51eda

  • SHA256

    47692eadbf8d27bab81f7c699d31a547d929a014409644a52c3d74e2fc66c7b3

  • SHA512

    e79eeb197653cad715df3fdf1e4ea3fae19be9e4b7dbd0b111256ddcb4116dd07f7e9c8d83babf7be88788138a51f51266581fd954d5bf4007ca651dae3d9e28

  • SSDEEP

    768:do5yT5jShB13iRYsiaK1dsE3iK+ReWoZHz08mXjWJU3YI5Fa5q/Z/ICSJ7OQU:do5yNjDet3iYHA8Y3YA45cu7a

  Score

  10^/10

  executionvipkeyloggercollectiondiscoverykeyloggerpersistencestealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2