Extracted

Extracted

• • Target

    26640240020_Dekont20250115_3662553.exe

  • Size

    914KB

  • MD5

    94c0d019eeca32a87b093d9463112eb2

  • SHA1

    76f8629459c6e3af0c39f2995acdc90b46fd05f3

  • SHA256

    f9075b95c77272f8c8f1b8fa996374c9c8e6bc0e2a6f1cbb6cc2fab34b9b589c

  • SHA512

    366ff882501d653332f335cf857c146f84ca97ed389e595962696317f2611019ac1afb418df40bdba5b6733599ce96ed20eb3063fab2ac1115db6be364ff670b

  • SSDEEP

    12288:jce26bXDUGTyWXV7OJoSVwNwiQB5U6msPljzkLS77wa73lP7os47+mluEqK6g/92:jce28DzxOuOfQ6p8LSfwaJ0ay9R6CAB

  Score

  10^/10

  vipkeyloggercollectiondiscoveryexecutionkeyloggerspywarestealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2