Extracted

Extracted

• • Target

    HPichHAekHXL0i2.exe

  • Size

    735KB

  • MD5

    25eaa2d8a1a973c77f37f07c0f0dd2fe

  • SHA1

    57f72cf8d22f5fd5e0472a928faeb938b7a362e7

  • SHA256

    1792b62467af9326272e0190ddd1e22c6217f23637ab47b9fbe0098ca3800c6d

  • SHA512

    487ef85e16c835b552e1ec43489e6c2b44a9d41b365c869a95f3206f3f75a5ed7842991a745222e1e36276411769bb36f8f4eec4824b22ddde82e2f0a94f2eb3

  • SSDEEP

    12288:NbdQiKaxRvjVoNUy/zS9iDCQJU5dlAW37yFPYELKa:pdQibRZy/cQCIwdlf3Qr

  Score

  10^/10

  vipkeyloggercollectiondiscoveryexecutionkeyloggerstealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Uses the VBS compiler for execution

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2