Extracted

Extracted

• • Target
    RFQ-097090-PO-07980-MM309680-2026.JS.js
  • Size 5.5MB
  • SHA256 b192a0e6bea225147fffd5d823ec5d28fc4a3528ed1883a9860a3fb0196a586c
  • MD5 2f7be547efff1195fc907e95c30c14b2
  • SHA1 0ae1802a20247b015bf3baaa311d21660345d86a
  • SHA512 7e110d89bdb3933fb336a466605467402e6c7dbbd7e519b6850db7c04edce942e07e397dca79678b841f67ad24d7e03af8f83c307d1326561944c2ccbf39164c
  • SSDEEP 98304:91lJf/4BKQJFjJGI9FPO+vcoieK6iCCpt8pQzspR6ovMiL79TWK6zoXOb4o5rb5o:CKwjZFWCcwLijpAsspR6ovMiL79qK6zG
  • TLSH
    T13946F7911744B3B27721DBAE563ADC21D48A520304E7CF11317ED2187FBDD0BAB68AE6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondefense_evasiondiscoveryexecutionvipkeyloggerkeyloggerpersistencespywarestealer

  • Family: VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion
  behavioral1behavioral2