Extracted

• • Target
    MV XINHONG PARTICULARS.pdf.scr.exe
  • Size 659KB
  • SHA256 cf5c60d3b7cbaf0ba4c33ca0d2a6710a00aec5671e2b494ade862dfde20ba011
  • MD5 361bd7b1e6ed23fe0492728bb61f2753
  • SHA1 6ef3f199b04c595ced0884b278eac1dc4beb60db
  • SHA512 c342edbc0608e751029b3c67a11640e638383aa020e43027ff4d94b49d7cf23743e7fa54a675c92edb7e7d25928f2ae532eb2f31f275740aa2ecca3bbfbc6c29
  • SSDEEP 12288:3N22VDIIoC+bth+tE+zZ7g/GaZ9ExkNQ/qBgglSY459i72l:4wzpEg6WZ7g/GaZxcPkE
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  vipkeyloggercollectioncredential_accessdiscoveryexecutionkeyloggerspywarestealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2