Extracted

• • Target

    weseethebestthingsevermadewithbestwithnewthingsgoodforme.hta

  • Size

    15KB

  • MD5

    933a3a73fc916b5969b456590f07639a

  • SHA1

    8d89004f709477415b2eaff08dd8ff569013973e

  • SHA256

    293e90ffa49e0d1a87813aeb2e071f47cce01b4e3772598ddb84f71963ad2806

  • SHA512

    b7901179ddf0a2051a284b0522f3e49a6af378675a11e78c546c016c350714a6b37ef5e51cec6ce9af1204999cc394937797627f7da7d0dbb5e63e51b66ac01a

  • SSDEEP

    48:3rN3QGu3nsQbP2wi+pgE71lW7L0v3LfPG:533u3pbP5iWgEHWS3j+

  Score

  10^/10

  vipkeyloggercollectiondefense_evasiondiscoveryexecutionkeyloggerstealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Evasion via Device Credential Deployment

    defense_evasionexecution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2