Extracted

• • Target

    7a7d66990ff3c8da825326eadd5a48ef8e3bf0f66cb9a69a886089d427b8eb7a.exe

  • Size

    935KB

  • MD5

    c592ac08db1b4c0988e2a465df9fc86d

  • SHA1

    a817467bc78db8376cfddb45d247cb47fe2fd0c6

  • SHA256

    7a7d66990ff3c8da825326eadd5a48ef8e3bf0f66cb9a69a886089d427b8eb7a

  • SHA512

    d7a92082b088f62ec899753777ff2a75ad37dfd8da6ac10b125e632a6d3756d4ca4da2a77193be75611c4d615b2a0fb9b50f318d2969f801a38cd7f3df3a313d

  • SSDEEP

    24576:9+AH7M28NNEDMj73JTlB2s0O8BD48rWHFDW+1RUrt:MsWNEDmJT7L0O8BD48rWHFDW+1Rut

  Score

  10^/10

  vipkeyloggerdiscoveryexecutionkeyloggerstealercollection

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2