Extracted

• • Target

    RFQ 2413AM-KE2800.scr

  • Size

    842KB

  • MD5

    261a093587e5f10ce389ace0cae77c90

  • SHA1

    f2a2abf88c0f6943b75c67ed3eea42428258ae5e

  • SHA256

    2c8cf59d58ccdfe9e35850251328241a99b7ebafe85fd5b7dc580db900e31e0f

  • SHA512

    41e64aae00e9e5bdaae34fbc4f9309b598f3444beb18d59686f27eccadd731f475852a7121eeb0de27c2405e741b8ea7b06925f3af72071a212332ac59e9fbb7

  • SSDEEP

    12288:yUmEQEhoN+zwDB0d3Mi6LaiOfHVrdz78a8mUSUFxdpVqWQuZoH:CEQEhoN+zwDB28idr5fUSUdVDQuZ

  Score

  10^/10

  vipkeyloggercollectiondiscoveryexecutionkeyloggerstealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2