Extracted

• • Target
    ALPHA WEB BANKING _ Απόδειξη Συναλλαγής..js
  • Size 814KB
  • SHA256 5d5cd70cf760b62aa3eb044cd0e9d0a9d70bedf9c277fc26eced2915a18087f3
  • MD5 2fc5dddf808b0447b6d430e2fc629080
  • SHA1 0366e214048220e35f437cd56568fe57b2d3c318
  • SHA512 a1b0370b5113594cb2c13c6800759d0a8a9e84553feaff0705e04043fa02e02623cd7685199e924aa6285ee7e4f024a352ce3de9a9e2d611d44457321b6c3b3c
  • SSDEEP 24576:v0gngT90w4YVLHRlUYn0XmGyIzER9s4fj512B5hycRF:vohIYvVr7R9s6jIz
  • TLSH
    T159058D9A9033DF3AD80879AC3B331993B7DC5536CF55AA609A8DDDBD10D846C39B09B0
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionvipkeyloggerkeyloggerpersistencestealerupx

  • Family: VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2