Extracted

Extracted

• • Target

    68765775002699ff32978e8cd956899391b045e273cf944cba0a4c13af820d18.exe

  • Size

    843KB

  • MD5

    aeabfd0534b39c526c6617466af1d780

  • SHA1

    7ffff117692cbcdeec136abd9bd7b15813d3ca35

  • SHA256

    68765775002699ff32978e8cd956899391b045e273cf944cba0a4c13af820d18

  • SHA512

    b7edcbda504deb93cfe9907eaf961dba3daf429e8d7f0442d6beab1e5741ced5810ba408d0787ef95e2a0d6b6169c4793223a05483b9c4c2c79540593c16010f

  • SSDEEP

    12288:ROovHlb/a13/KiTO5rry72+QwfgivOKFd01e0B:RZle1vHTO5r9Cl0B

  Score

  10^/10

  vipkeyloggerdiscoverykeyloggerpersistencestealercollection

  • Modifies WinLogon for persistence

    persistence

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2