Extracted

• • Target
    Demande d'achat.vbs
  • Size 1.8MB
  • SHA256 f561b12449a57e46af4e4365045ddce6f8a40847b89ede7494dc724af75fc9e1
  • MD5 9c3dc4f917e5a8bce7f9044596caed03
  • SHA1 4eadde060f02eb66ffe070d8cb0428fa46f2f209
  • SHA512 a5f9cd3fa0134944e0410242b236b55c52f7fcc398cf31f50e7a9118670e1d10fe586c3affb8fb2a9316c350cfb8705674ec3e6811e1758bb03db527e9a14033
  • SSDEEP 24576:OP/6paLnzvMH5w1xq/FptP+RSI/Qo3nKyTa23gh6uf6v8nssagyvctB7XkpV60pm:TwnGwuptG3nZR3I6xvt8B70m0pDs7
  • TLSH
    T1CB85AE6A13C78F1E253C1A7D58C63B08A4D43E92697DCED1CAE3254267215E132BF4BE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionvipkeyloggerkeyloggerpersistencestealerupx

  • Family: VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2