Extracted

Extracted

• • Target
    RFP-000000189836 (AA-26125-MLNG)_ 25082026_ 11.59PM.js
  • Size 74KB
  • SHA256 c53e3ba32f519235dd00fe2aec3392fbd19d312db95f30ec4ed623b908627f3e
  • MD5 298a47507bae9ab2839e1b281c06de97
  • SHA1 d8805a1eaad342d50d8b885b292db9ec97bf687b
  • SHA512 0b37a244ea51e1151d8590edab1ebd6ca57584ca663e5f297dc285b7a09cd9777d128017d018f8fd6cf3e4075b49aed884001aedc663c51f737817724daf2e06
  • SSDEEP 768:0loGrIoNhsLGCe/LabpcAfh1MlfhIgfbfRgFpEek5PdaQ0oRK9913AfeAeL65/p8:PGrITbZg0qSgPEP
  • TLSH
    T17A730E0859C3698413376B7FB32BBC95F67A07670184490BB83D6860AFF2D19F9D18B9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionvipkeyloggerkeyloggerstealer

  • Family: VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • ConfuserEx .NET packer

    Detects ConfuserEx .NET packer.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2