Extracted

Extracted

• • Target
    Proforma Invoice_21-1541 And Packing List.pdf.exe
  • Size 669KB
  • SHA256 8a48ce8db35cc289949562cae156fce70a8e7f913b35515bce4cdc2741152b8b
  • MD5 735a7df205549792227de19741161bf4
  • SHA1 eaf1a198d5d1b3fcb9f800d904fb77fcf292dd4f
  • SHA512 11f6c19323b3b6da9a157588351c5acc50ac1b0379cff58434d6954080a6b98c1bfdc8e097dc5824d4172c69edbcf2b0cc5461f3122c02a55fbe4a38a942733d
  • SSDEEP 12288:sTw4mLTyKugzOg26FAoIP8Idfhp/cmHl3uVXsW5BnX6Yft2zKL3wJdidN4Q:sT0L2MRJFALL9xzW63zK0JdidN
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  vipkeyloggercollectiondiscoveryexecutionkeyloggerspywarestealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2