Extracted

Extracted

• • Target

    Payment Swift Copy.pif

  • Size

    890KB

  • MD5

    d289e495195c9e64539e604e037762ac

  • SHA1

    6651238d349b1657a78fd921f1f55e4d38cce9e3

  • SHA256

    c4e0167682813d15e807830fd194456713d3d4c155ec8613d3f588e55e8a6d7b

  • SHA512

    8ba6be9ec42fca233696ad0d21ae95b722d67a524a533fed60e2fa5235f0a00c763f5be3a26dd8172293073ef958273147fae27e4e777fe218fb78d7c468e774

  • SSDEEP

    24576:WRteh9ZIby7BxeAchjtNefGaG5YtLo4DFpLf8U:WRtehLH7LchCJtLPFqU

  Score

  10^/10

  vipkeyloggerdiscoveryexecutionkeyloggerstealercollection

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2