Extracted

• • Target

    Data Sheet_Technical Requisition.vbs

  • Size

    97KB

  • MD5

    fb96faddeb253f2dc7f5ebc646b9577d

  • SHA1

    f99b1242624a2f6fd10675ebcf0d434002132f07

  • SHA256

    a1793711d90913e75edd176658b83e254324afc51e54f787aae45062363fb22d

  • SHA512

    3c75f19bbdf9b63225928294dbbd76fab2513cc8c225716f9779b49919c204cca5c6fe56fe4a23ca31b96baec337c57099658f762f3d9e68b101236b06b77e53

  • SSDEEP

    1536:PIqKuiFeYv5YBGz/tDFcjCf9OiLFRnTTFR1//fyszzooL5DxATTfq/C5DO:PIqKnFlYMz/NFqCf9Dnhrzv6fV5DO

  Score

  10^/10

  vipkeyloggerdiscoveryexecutionkeyloggerstealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Network Service Discovery

    Attempt to gather information on host's network.

    discovery

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2