Extracted

• • Target

    jxGidTkOad4suSF.exe

  • Size

    869KB

  • MD5

    24fe4f00c34617dbda65dea7b69290fa

  • SHA1

    652ca5827811da26020b27267574e93b4e3a0a1b

  • SHA256

    2cabff0ab44ef8b5791f5ec5c5dc25f509a6ca502af94813cab8fcfcdc6abfa9

  • SHA512

    e09ecb5ee06b5f61aa7dcbd1db757851224b8822c3765eff5f5066aa761a017376eb24688534935c8c9b33120a5332e8ecfeb225d52a96c178cec5116e195952

  • SSDEEP

    12288:NMvDFVzJ+Wnqn++PtFmwH9PD3yy6EtS1YFbOWKkhrINsuNQxv3yfiuiKMF4Ezh0W:NMbHzMjowH9bZsq0W1rubNmfEid3Ho

  Score

  10^/10

  vipkeyloggercollectiondiscoveryexecutionkeyloggerstealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Uses the VBS compiler for execution

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2