Extracted

• • Target
    SecuriteInfo.com.Win32.CrypterX-gen.7283.28807.exe
  • Size 693KB
  • SHA256 dbbe44a73528de0f741edc23e20665e27678fa3a966df5409f3cf4e86c3277ed
  • MD5 2fc9baec5722a22fe1444369cbb72b69
  • SHA1 4055a52d42b7dece0a4e6dc364d0d0d0130ba76f
  • SHA512 15e879271370ec38ed4ad12e0a4031cce8d078648c48c762f2d9a33bad16cacc24281cdba97880bbb1d732f696aed679b5e6f131fdee5262a1f10a48ec95cb73
  • SSDEEP 12288:60l3HewdzbFysIJl9NShAOYXBBG4EcOpLLdI6rjjItC9taD56faUOoW0:8w5xy579iAOYRg4EXpPddItC9g1m+o
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  discoveryexecutionvipkeyloggercollectioncredential_accesskeyloggerspywarestealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2