Extracted

Extracted

• • Target
    ELITE VALVES RFQ NO_6000112038_ADN_25_technical_bid_submission_sheet.pdf.exe
  • Size 725KB
  • SHA256 57ddc71d4ceabf26512f5bf88152f41b543de6cc7080b8d5660c43badd4dbd4d
  • MD5 3d8571f6b73b3a2c81742f1ebf74c2d3
  • SHA1 bd43a63c5f3854ea4bb649e30d4fe4d44fbcdd7d
  • SHA512 4b2b1e2ac3c4163663e47b26ea36053fc8b627e20f88f834f434c10a99ce130c65185a967885c954f91777c53a5f471f2378a2573f7793d4482ad1af02405864
  • SSDEEP 12288:hRnwj8oSnVZoE2DzQAZ39U1Q4FAtsRO2X45Nchan217Lhp33jBes:0TSVZoTkA19CQ4WCVX
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  vipkeyloggercollectiondefense_evasiondiscoveryexecutionkeyloggerspywarestealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Modifies trusted root certificate store through registry

    A root certificate was added, modified, or removed in the trusted certificate store registry paths.

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2