Extracted

• • Target
    Requisitos detallados E9988001MX_.js
  • Size 1.0MB
  • SHA256 534de2e2084c11983e3aceb7e6d272dc73a3f7a60d782aa242ce657525b97b0b
  • MD5 d14a040103699cc9df357322f3f31998
  • SHA1 d940d8dd4f7d3eb4a705c0ab771ed8a922da3861
  • SHA512 cc830debaf7bd0168656743bb154476c76af6200e753b21cf1decb2315b9ce4043fb2ec6a16e3f5f9c6ad7347eda8ded4c9c9bbd4e75e44420af1e2737d8bd4b
  • SSDEEP 24576:DGvuKAyTPuN7eUuJ4boOzWA2li8crOKDgZ1Q1Y1BZhrp0GMBHxYeQ8uWtxA/:beUSfHn1ThyUFok
  • TLSH
    T19A35D1947FA030AFE34C9AD5031F539B41F49D822E095487B7BEC786773AA82CC75A49
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionvipkeyloggerkeyloggerpersistencestealer

  • Family: VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2