Extracted

Extracted

• • Target
    RFQ-0809-CME-2602523-PO-08909-09-26-079-Ref-06868.JS
  • Size 3.4MB
  • SHA256 2c4da1bdb6af6eb82f1718adb6fed408ac0a8f8b4530587cd70c1a56368a1481
  • MD5 804788739f1e24a1e0cf88c639737f4a
  • SHA1 4a5052ff6677b9f3c5e54654753aea9877e374b3
  • SHA512 71e8d8fa6b6872d1c929b6eeadc5ad67f2e2112f051ccff5be5e6c10187777dca0100b0f44f882b570c56c8ec7c1d84cda7015f68fd71e1d733c046648ea4063
  • SSDEEP 98304:qNoRT2K2Pd6S39bxH8boxsjMvJo4ceRPONUbYJURZPzIcrNQyz19T6Ijg4zWbsGU:qNosK2PsSNbxMouMGneJYkZEcJQyz19j
  • TLSH
    T1CAF5A191938AA233F7356B6C86369C70940E562B15C5DB3530BEE6077B6CD0F631CAE2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondefense_evasiondiscoveryexecutionvipkeyloggerkeyloggerpersistencespywarestealer

  • Family: VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion
  behavioral1behavioral2