Extracted

Extracted

• • Target
    f7d2aeb3c3f8d1bec48bbf92745cc52825a00a57dcda82d2b4ac2f09c87f373c.exe
  • Size 696KB
  • SHA256 f7d2aeb3c3f8d1bec48bbf92745cc52825a00a57dcda82d2b4ac2f09c87f373c
  • MD5 f57edbfdbbcbc25595127be85eee7500
  • SHA1 022075699917149c279e281184bada53db621d1f
  • SHA512 ede3c2db081eaac3cfee3c03a52e516c3ca4b676f2df572eb4c12cda8e6627fec1f451f86162c373947a0002ad1152b586991cd455e6a36ca10b12bb2a9feb31
  • SSDEEP 12288:pjwbjA3qo32kzh/XQ7VvWReNgb2sMmFaKZX/makglqU1HxH7M+/eZHG9SueDpO0x:0jA6o5zhvCVvaeNgBMmPNuak41HVM+/+
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  vipkeyloggercollectiondiscoveryexecutionkeyloggerpersistencestealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • SmartAssembly .NET packer

    Detects SmartAssembly .NET packer.

  • Suspicious use of SetThreadContext

  behavioral1