Extracted

• • Target
    SecuriteInfo.com.Win32.DropperX-gen.23511.10885.exe
  • Size 956KB
  • SHA256 015c7dcc98fd7bbe4f627b0e2645fae31972aad932db069d22fdfdb793b62ad5
  • MD5 e1dfe7c36363a3127acdb5ff11c35af9
  • SHA1 8578de3001cc7fcef9ce8a2d0ddba7fd2ce171e9
  • SHA512 a0fe75174af1a57f72756914cd4c3ca4f7f20e5b9d54546cdaa9a3e2b4156cdadd9a060ab1eb159dd732121ab092dea98ee989cf41ad1e30853101c12f68fc3e
  • SSDEEP 24576:dnOeiMOiXBVlVlVVVWvwjgJo/vWf+AqaVOwzMwRvSU2FNr2WRVlV7:KMpRPPPwvxJYv++ArVOOMgvShPr22Px
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  vipkeyloggercollectiondiscoveryexecutionkeyloggerstealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2