Extracted

• • Target

    6cae02b9c53e25101109e266fc3ad28aa093aca1cb1313b0a67e942d1503e106N.exe

  • Size

    935KB

  • MD5

    9a8b2f175cdbb6e8c709a39a11ba7a90

  • SHA1

    62e576084c556ad5d1d3370db2af94a367d351ba

  • SHA256

    6cae02b9c53e25101109e266fc3ad28aa093aca1cb1313b0a67e942d1503e106

  • SHA512

    66dad6f1475c673712380dfa832a7b6c005563df1645995758fa93571f93dc1fe7378237b55afc6f7363260b553fbe95e9ae8c1e40ab2b2817b823dce9e701b5

  • SSDEEP

    24576:9+AH7M28NNEDMj73JTlB2s0O8BD48rWHFDW+1RUrV:MsWNEDmJT7L0O8BD48rWHFDW+1RuV

  Score

  10^/10

  vipkeyloggercollectiondiscoveryexecutionkeyloggerstealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2