Extracted

• • Target
    eb825b11d00bc3ec41e7856a59ebe1027e3f9c9128a177e182f688535f22bfb6.exe
  • Size 1.1MB
  • SHA256 eb825b11d00bc3ec41e7856a59ebe1027e3f9c9128a177e182f688535f22bfb6
  • MD5 5bf012702d620d125fa7adc2bd3a9c75
  • SHA1 2c13edf47861d5a003ccd2a640ebb91d42ffb71f
  • SHA512 fe0327f7664486f10bf5bae7a5a0496c19c2b8446a4745f2ae3f32627f47b740d15f0c60eac6eda9e145744149483a0132aaa1dfb22853a54d7b69eeaa8aa645
  • SSDEEP 24576:K5xolYQY6shA/j7kdrkwUEoNh8L7PgjnT:dYdh4j4drHch8LEnT
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  vipkeyloggercollectiondiscoveryevasionexecutionkeyloggerpersistencespywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2