Extracted

• • Target

    e6ec9d636764ea359892802c6e3298e8e3f4326d577f95c7c4f5aad02c4390f0.exe

  • Size

    994KB

  • MD5

    ff87a7084cb90a90e940c72dc2b6d7fa

  • SHA1

    8b8b81a956a2d145af1c02cbe56c2bf08ea3a388

  • SHA256

    e6ec9d636764ea359892802c6e3298e8e3f4326d577f95c7c4f5aad02c4390f0

  • SHA512

    f37f460e64026235157ca48c6535f157b2070ac7cea67d3c71ae8d725420e2fed3fa364cdbc116237f1fe1a2b509b2ccde9928d5cceeea43f2c906565e3c6c7a

  • SSDEEP

    24576:Yij0gzjizxWgioJqE9p9jzOtXGnwaEalbcHNGtAlUDRLP:1zjkW2H9p9PmXMOHNzUDBP

  Score

  10^/10

  vipkeyloggercollectiondiscoveryexecutionkeyloggerspywarestealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2