Extracted

Extracted

• • Target
    z27RFQ.exe
  • Size 1015KB
  • SHA256 0e2ce00e002ee4a25c0a888788de2fcafab8d293fb034163bb3e1bf34151c452
  • MD5 d07f1dd60d7c6a11ab0d160a8314bb40
  • SHA1 8d736d69695fc4c47b3c4d0f31699afc21d86a9c
  • SHA512 c4d3ae8f37319533a484bb35d8de249f98cf533cde13d1a197832765b4563e93c1dc9e4ee297049e4b28cb5ab9821ff96fb79706c7f13693754e77dddfbffe8c
  • SSDEEP 24576:xu6J33O0c+JY5UZ+XC0kGso6FaK1OL5kiWY:ju0c++OCvkGs9FaUOL5MY
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  vipkeyloggercollectiondiscoverykeyloggerstealeradwarepersistenceprivilege_escalation

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Downloads MZ/PE file

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Installs/modifies Browser Helper Object

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2