Extracted

Extracted

• • Target
    Factura Rectificativa ES 2025.11.06.vbs
  • Size 289KB
  • SHA256 6f96b534bcfec55b97dbeb18cbeaf59c2a7b745e667fea1a0998b1ff9df72b45
  • MD5 4ab207cdef81ceca90607bdb62aef2a6
  • SHA1 7c2f299296ba696572d38dc475f65c1077edd9d4
  • SHA512 25c6211151ba1e1ba59cdbac43540d069e21edfd9c1c80c3995a101e2ab8c77c28e791e1f356da8da8dd786777c2ba543e96ea093eccfaff1be4af6cd719ccd1
  • SSDEEP 6144:rsugAp5sa+i2CnxIZaLF+FgAXf7asJIyIlbFnpmyLyMEvrQ6KwKCBaejPg:f+Dvp9BM
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  collectiondiscoveryexecutionvipkeyloggerkeyloggerstealer

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Drops startup file

  • Accesses Microsoft Outlook profiles

    collection

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2