Extracted

• • Target

    PO#241338.scr

  • Size

    916KB

  • MD5

    1f9a219a3d4f7c497c3f6d6cb47bcc77

  • SHA1

    064ee4b1212e99be9857020c63726fa3aa88c079

  • SHA256

    105bcf11c1495556915d031574274e27a636b1e32f6b45a22bdb440ec1796b66

  • SHA512

    c5639c4f6a4b5670347b6a735c3f979c8b03ba2f7574080ef775eaab8b522e986dc25c80299a910282b9ad03444bccd7cb468d8e8aaf6a6da44ce452e85136bb

  • SSDEEP

    24576:FMRHPv6tkV37EUl8T5UfupJvjniUNsiQMRH:FMZqaV3Vl842vbZTQMZ

  Score

  10^/10

  vipkeyloggercollectiondiscoveryexecutionkeyloggerstealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2