Extracted

• • Target
    SecuriteInfo.com.Win32.MalwareX-gen.64731711.exe
  • Size 915KB
  • SHA256 c9e434249c8233d35e8bb5a03cdd049a100ed54ecb6d1080b25b3aabcc73f2e5
  • MD5 9e76617f3bb207e3bbdb2df9528d33ee
  • SHA1 a75af01ba4d6bc0b5df3ca2de97b12a639346abf
  • SHA512 8de7985c8890e867319a5f3b679177af321be725d0cf07ff90599972eacfd368fb79616a7b3fe1124287217050beb29a1642e075ca540bfa23d04e2e9a09b15f
  • SSDEEP 24576:uI9RQUMGw1r4eEFPF03tySt4r8IWiH57N:uk/BRN4t7IW85
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  collectiondiscoveryexecutionvipkeyloggerkeyloggerspywarestealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2