Extracted

• • Target

    PO-009 Compurent.exe

  • Size

    658KB

  • MD5

    339e40c9c69f587ecf57fb4f34df3da0

  • SHA1

    fe477958b4a728dab031ecbd5ea0c6a9a985c467

  • SHA256

    5e27cf81fa5bf72f66bdb2bba36e9bd04f231ea0c27327b7fbe71370a32c306b

  • SHA512

    c33535028de2ad8c05db54f85f7184ea0805a97d30f6187993b8204c53d8885afd787503b714cbebb0ef787fc46352ae00ebf903742156f348088bc8b6dcade5

  • SSDEEP

    12288:X17kvBCirdHKzxLEJIOjeaIc0mZ7DXiWbv5O9EBOw1jbWfOJyEqum6coTr4:X1ociZYiJ/sSDXzB8w122JYoTk

  Score

  10^/10

  vipkeyloggercollectiondiscoveryexecutionkeyloggerstealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2