Extracted

• • Target

    cbe61e9038fcec33f02c0821aec4fd71.exe

  • Size

    864KB

  • MD5

    cbe61e9038fcec33f02c0821aec4fd71

  • SHA1

    4c17ce6e305342df5becf4c17179c02c69944adf

  • SHA256

    0286690ba3e9b859e9fd52d6344d65a00987556394a224da17cfc5fb3a87c3ad

  • SHA512

    8f8f967d194a72d294d81b1efae61c68e9d216333fc8065c91fca73a6158996e8e505436c101b78e4c2753043ac8426f0325117ebbb3c7d97577d80d4003bfe7

  • SSDEEP

    12288:jL3rQQJFkHuUbhRJ9GJBrlK3LytLtksIcF3RZJs7w4grdxUQGlqssDMRlY3:LQgFYu4b4tecptslIdx8qssUY

  Score

  10^/10

  vipkeyloggercollectiondiscoveryexecutionkeyloggerspywarestealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2