Extracted

Extracted

• • Target

    1092817034_DCTAZ100_2025_23176136_1.jse

  • Size

    309KB

  • MD5

    d97ac5a9ac461d2137606480b79db1c4

  • SHA1

    dda801ef5e48dd7510e7cb8380f316d7a7147265

  • SHA256

    98c41f03c8e8c2b2246014f1cb0a49b2b71afc60c0e83ed33e5ad4e783418703

  • SHA512

    283b076b0ca30bee97e1da8d87460bc6668533608c26370325a0273070bce38165ce2be3eb75662eaa85b6176076fc1fc6f15c2970006d2bc817e714c5735638

  • SSDEEP

    3072:5vJ5HovJ5HovJ5HovJ5H7vJ5HovJ5HovJ5HovJ5H4vJ5HovJ5HovJ5HovJ5HuGnG:L4BL

  Score

  10^/10

  executionvipkeyloggercollectiondiscoverykeyloggerstealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2