vipkeylogger | ca4825809c14563a8b308eed79d058d950d908476bd0bda6fd56bd6e9e0ececa

Analysis

max time kernel
149s
max time network
156s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
24/04/2026, 19:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
akrhwpmvbdfewonmcvjn7rzcdhj7t.js
Size 1.6MB
Sample260424-yn7ppsgs4z
SHA256 ca4825809c14563a8b308eed79d058d950d908476bd0bda6fd56bd6e9e0ececa
MD5 f2279d7e314b2a985eb925e7f44b90de
SHA1 44c9e780a55a584e1ae6455f53fb3d6017f449d8
SHA512 ab8ce3650f847a43168ce35996bae468d8bd97833b45001fecfdc703f112398443c6f4f03d0f080f01ea6648873dd17caa881b8703feac598d0bd3ccd58a1bab
SSDEEP 24576:DY+vpUtb34XoAuM0/JcjXiDJyEj2OtoDW4KycR+tWof4ZDhRCPnvl:KrA8cDMJiPKtoktsPnvl
TLSH
T16075020199C43FB8CF6C661950FE251EA3B0498A941AB48AFB73BD4AFFF7A0441175D8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection defense_evasion discovery execution vipkeylogger keylogger stealer

Malware Config

Extracted

Family

vipkeylogger

Credentials

Protocol
smtp
Host
hosting2.ro.hostsailor.com
Port
587
Username
[email protected]
Password
7213575aceACE@@#
Email to
[email protected]

https://api.telegram.org/bot8099843793:AAGeYKMLti1IpyT9o6bz7OtgdXF9md25uXA/sendMessage?chat_id=6337180137

Signatures

Family: VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
stealer keylogger vipkeylogger

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4312	powershell.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	checkip.dyndns.org
1	reallyfreegeoip.org
3	reallyfreegeoip.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4312 set thread context of 4200	4312	powershell.exe	87

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
4040	taskkill.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
4312	powershell.exe
4312	powershell.exe
4312	powershell.exe
4312	powershell.exe
4312	powershell.exe
4312	powershell.exe
4312	powershell.exe
4312	powershell.exe
4312	powershell.exe
4312	powershell.exe
4312	powershell.exe
4312	powershell.exe
4312	powershell.exe
4312	powershell.exe
4200	aspnet_compiler.exe
4312	powershell.exe
4200	aspnet_compiler.exe
4312	powershell.exe
4312	powershell.exe
4312	powershell.exe
4312	powershell.exe
4312	powershell.exe
4312	powershell.exe
4312	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4312	powershell.exe
Token: SeDebugPrivilege	4200	aspnet_compiler.exe
Token: SeDebugPrivilege	4040	taskkill.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3128 wrote to memory of 4312	3128	wscript.exe	80
PID 4312 wrote to memory of 1468	4312	powershell.exe	82
PID 4312 wrote to memory of 580	4312	powershell.exe	83
PID 4312 wrote to memory of 4688	4312	powershell.exe	84
PID 4312 wrote to memory of 3308	4312	powershell.exe	85
PID 4312 wrote to memory of 1880	4312	powershell.exe	86
PID 4312 wrote to memory of 4200	4312	powershell.exe	87
PID 4312 wrote to memory of 4200	4312	powershell.exe	87
PID 4312 wrote to memory of 4200	4312	powershell.exe	87
PID 4312 wrote to memory of 4200	4312	powershell.exe	87
PID 4312 wrote to memory of 4200	4312	powershell.exe	87
PID 3128 wrote to memory of 4040	3128	wscript.exe	89

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\akrhwpmvbdfewonmcvjn7rzcdhj7t.js
1⤵
- Suspicious use of WriteProcessMemory
PID:3128
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -File "C:\Temp\ps_dNPiCeOe14Wd_1777060635146.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4312
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:1468
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:580
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:4688
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:3308
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:1880
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - Accesses Microsoft Outlook profiles
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    - outlook_win_path
    PID:4200
- C:\Windows\System32\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im wscript.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4040

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ps_dNPiCeOe14Wd_1777060635146.ps1

Path C:\Temp\ps_dNPiCeOe14Wd_1777060635146.ps1
Size 1.2MB
SHA256 0c8e1b65a076a71d657e0667c5f9c16e02d1a51324be8829535e85c9c88b59d0
MD5 b25be16d675c20a3ea79d8533496f966
SHA1 018a8e3b81a6449741cb21c0b3ea4bdb7914859c
SHA512 3076dc0b5194fcf77a89ee863308edb01dedfb7fbbc6db2f40a54df885ba8b0b9b39f7ca14ebe4c214d6fda42c26d142953adc2f3b68ff536942c40a57512dd3
SSDEEP 24576:F3jYqLycAyP70V8cx5JkZvaD5YRm8UH2deF8ZZHRckbzzgdgVT:dXLuHJu1Rf9bgCV
TLSH
T1384523B05D4B2DF507A8A358B37BEF49936ACB002498FC43FA2261531BECFCA7152591
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_ousyproj.3qg.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ousyproj.3qg.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3128-17-0x0000023A9CC90000-0x0000023A9CD3F000-memory.dmp

Download

memory/3128-18-0x0000023A9CD40000-0x0000023A9CD4C000-memory.dmp

Download

memory/4040-55-0x00000238D74F0000-0x00000238D75C6000-memory.dmp

Download

memory/4200-25-0x00000000051B0000-0x0000000005271000-memory.dmp

Download

memory/4200-31-0x00000000063A0000-0x0000000006562000-memory.dmp

Download

memory/4200-13-0x0000000000400000-0x0000000000448000-memory.dmp

Download

memory/4200-14-0x0000000005460000-0x0000000005A06000-memory.dmp

Download

memory/4200-15-0x0000000004F50000-0x0000000004FEC000-memory.dmp

Download

memory/4200-40-0x0000000006370000-0x000000000637A000-memory.dmp

Download

memory/4200-39-0x0000000006670000-0x0000000006702000-memory.dmp

Download

memory/4200-32-0x0000000006220000-0x0000000006270000-memory.dmp

Download

memory/4312-23-0x00000218889D0000-0x00000218889E0000-memory.dmp

Download

memory/4312-12-0x0000021888BD0000-0x0000021888BE6000-memory.dmp

Download

memory/4312-22-0x00000218889B0000-0x00000218889C2000-memory.dmp

Download

memory/4312-21-0x00000218888E0000-0x00000218888EC000-memory.dmp

Download

memory/4312-20-0x0000021886E80000-0x000002188702C000-memory.dmp

Download

memory/4312-1-0x00000218889D0000-0x00000218889E0000-memory.dmp

Download

memory/4312-19-0x00000218889D0000-0x00000218889E0000-memory.dmp

Download

memory/4312-9-0x00000218889D0000-0x00000218889E0000-memory.dmp

Download

memory/4312-11-0x0000021888A60000-0x0000021888A76000-memory.dmp

Download

memory/4312-16-0x00000218889D0000-0x00000218889E0000-memory.dmp

Download

memory/4312-50-0x0000021886E80000-0x000002188702C000-memory.dmp

Download

memory/4312-8-0x0000021888BA0000-0x0000021888BC2000-memory.dmp

Download