Extracted

Extracted

• • Target

    rShippingDocuments240384.exe

  • Size

    771KB

  • MD5

    70338f79bb11ee88003ea5f2d0d363c1

  • SHA1

    85d426e23b7223faacea8b78c6de345098ccfbad

  • SHA256

    50bcb2857ce3d005fad3479253fa1c7a8cf0cd667c16d9d7c292d9307011dadf

  • SHA512

    bace26acc95d929c703e437d5adc360bb54190aaa6f054ff4e77a9bc183bf17603f4a806344de80538c0669ede1c5f085bae9c2a355cbfdbd3cf2d08c2df8295

  • SSDEEP

    12288:113LrfXYb+9JKV6WpWlCFl2SQ2gkXb4uvzt0FpIrlIK25FBc:nYb+9i11HDIkXb4gztLIDFBc

  Score

  10^/10

  vipkeyloggercollectiondiscoveryexecutionkeyloggerstealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2