Extracted

• • Target
    08fc3b1fd5055344609064d31139e4a8e1c26d8c5d353b1ca97b4148f03d8823.exe
  • Size 863KB
  • SHA256 08fc3b1fd5055344609064d31139e4a8e1c26d8c5d353b1ca97b4148f03d8823
  • MD5 b4560c5e033de5dc4a3d37cb865fa1db
  • SHA1 f3bce1309b808633b621c6ba0fbdb221d8b9942d
  • SHA512 f04c325b2a9cbf17e7cbb0978f9ee09d45f87cdc31dea7c077519f5bb5c4d7f0f15db08bffe1cd3efb725945f3ae7141d05e58fa20507e603af6722c84be6f1f
  • SSDEEP 24576:baUbErVbCx3YNAd1tyrh8+Rg8EFRRGmDPquc7/:7ElCy4tyipQmDPqu
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  vipkeyloggercollectiondiscoveryexecutionkeyloggerspywarestealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2