Extracted

• • Target
    VN-EN-PTSC-Request2026.js
  • Size 2.3MB
  • SHA256 dd4c9e4f0f4a9bba94316a2286bea244a435f91b467f8523cccdceb237f03b9b
  • MD5 3349bc8bcffe24c797e74a845de35b61
  • SHA1 e90ca691c321589ccdf538eaafbff05528534cee
  • SHA512 14d0a4036e37f4e7c32d718c71938251e123d802c864b7eda37dd0e4cc53d6e7c9e4b07f47797dc1db7c20a1fb2e1d7123745eed3db7e2b7a869a078c28ecd7e
  • SSDEEP 12288:LX/G/8Rt2FfCTcr4wossjc2peDIziKHr+vaUwJ6ersl2nIpWEKzzr8Ae2Y2:LaiACTcip
  • TLSH
    T1A6B5D7A763DEB5826D06739C540E78884F8EAA164D03F0D1B8EE4BC4964F09F6981DDF
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionvipkeyloggerkeyloggerstealercollection

  • Family: VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2