Extracted

• • Target

    dc9e448e51f4504726d8fdccfce805dfb4c228091f12a194fef40b2a86aa5eb2.exe

  • Size

    1015KB

  • MD5

    f70379292f5c009d309aa771803b8a47

  • SHA1

    146e5ac87cb3c65624b027fa925861be2bde0003

  • SHA256

    dc9e448e51f4504726d8fdccfce805dfb4c228091f12a194fef40b2a86aa5eb2

  • SHA512

    3eb75605563f10f5a48ed01dd07d4ad31a8e35a511504d5fa50ca64e1d4d7b96a7a538cadd13983e537a6ea1201f0b2a50da0122d3573a2ce4b665e7749a8f80

  • SSDEEP

    24576:1vfVYijKZquDiAot5zwlGaZkAAeWnhl4Ruyh:1vfV/jKskibXqGlnX4ck

  Score

  10^/10

  vipkeyloggercollectiondiscoveryexecutionkeyloggerspywarestealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2