Extracted

• • Target

    a7dcfd4b6de3f06fdfd1a77b23a4ac800db43cfc3772cd6f202f761d2fee1f96.exe

  • Size

    1.1MB

  • MD5

    68599066747e20a712331a13afc77193

  • SHA1

    71fd458969f00a6e999682917b4a197cd06da4e9

  • SHA256

    a7dcfd4b6de3f06fdfd1a77b23a4ac800db43cfc3772cd6f202f761d2fee1f96

  • SHA512

    7a83c1afb3f071309e62db9c5706d67989006734a14e9df53fab7ccd3bae7b69039366e7867cbe94bc21f14371d473ce116c795e637f882c0e2a997fce7ec656

  • SSDEEP

    24576:KkUw9mSJ2i7UbIISiYV8AoipSS9/D1mM:9J2i7mwVXoiN/D1m

  Score

  10^/10

  vipkeyloggercollectiondiscoveryexecutionkeyloggerspywarestealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2