Extracted

• • Target

    z1DHLSTATEMENTOFACCOUNT-1004419433.scr.exe

  • Size

    747KB

  • MD5

    e23a0e661b5e3a37167649937084e097

  • SHA1

    8b88d749bc5ee572a121d26e3a38509b3393d262

  • SHA256

    30637194a7056733700f36087eac01a1d08e64c38121ed67f632adffb8655785

  • SHA512

    03c90ad6e99d7cfe4e1cab1704c9e62c0e79102fd7179825b56913a1c19e9ca8ec5610b9f3ffbc1827185581b8c9256b309ff08a29494b8ea99b848a889e7e2c

  • SSDEEP

    12288:6yQiKax2OkSr9dAYd+nNbKuZWESBeNxCMmqtT5ZF/363NvkR:nQifrAYd+BKuZWEMeXLmATD9yNq

  Score

  10^/10

  vipkeyloggercollectiondiscoveryexecutionkeyloggerstealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2