Extracted

• • Target

    pre-alert.exe

  • Size

    1.2MB

  • MD5

    aedc7ecabe46230d60a8059c86ddda08

  • SHA1

    236dfa67dd9cd0c01500aa0a04c80aa3ca577d1c

  • SHA256

    f9925fbe9ba09a653092fabbcf4b097e46651f500ae7cfaf1f68515168b333c5

  • SHA512

    e26c1bece49d319a3777291fd94ba3fefd364940a2cb06cfc3a6cdc8a781c2aee5402db0cadd4d4a5780463662642ece5bec0fc3647103e6633ace07a16fc352

  • SSDEEP

    24576:tq5eIN453LV5B4v/cug7em7x0XsC6jjR5yPDNFo2s0O8BD48rWHFDW+1RUrK:vIN2Z5B5zem7x0TY5yPDfoL0O8BD48rC

  Score

  10^/10

  vipkeyloggercollectiondiscoveryexecutionkeyloggerstealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2