Extracted

Extracted

• • Target
    ENQ-NO-057909-PO-06970-MQQ-06870-07-2026.JS.js
  • Size 3.3MB
  • SHA256 05b0c6e205850a67405800e0c060f3c15065c468c39df61e58d91475217100e4
  • MD5 2c002c9e9e0b2c0fa246eef3746c3437
  • SHA1 381b299e72b890c2be760766baac8f84eab6775f
  • SHA512 afd64e46a6b6425309f4b35f76ccb9308241ef8ad12238bc9a8c5822cd2dddcf24b97b87c87e2a742322ef4e809804f62e3f935d3b2b3824cbce175bb57d05c7
  • SSDEEP 98304:QAT2ziqJ9Ly1qhJwaEtI3YBj/9DicY5L5uM8yyt4qUGVHujabI5GiQRsaGWvN51Q:t2u09LMAuaCt/zJM8X5ZujabI5GiQnJk
  • TLSH
    T187F53A511798A1737720E7AC563AEE74A80F904328DACF45385ED2247A5DD4BA38CBF3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionvipkeyloggerkeyloggerspywarestealer

  • Family: VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2