Extracted

• • Target
    SecuriteInfo.com.Variant.Genie.8DN.1118.28021.9981.exe
  • Size 672KB
  • SHA256 5415bb0ee37a92106e7f85fa4cce32678415abcf0fef84776004d559dd8a92bf
  • MD5 7206f0092c0b5a2eba8cd821195a7cd7
  • SHA1 b8a5bd5a448585d62f4e476050955698442b2a6f
  • SHA512 9af1f25a0b4dd11adb80146933dd8982b34e91e070eb185d4806e988ffb8b55544ef88f9dc84de318440886c22c65b7c413ab719a063732553627efe827f9024
  • SSDEEP 12288:MmHE1anFOBLkmhaumX0/Je6ETBgAv4ARhhNWI8CcFR:0OFOKmBPr8BfA+jNe
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  collectiondefense_evasiondiscoveryevasionexecutionvipkeyloggerkeyloggerstealertrojan

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Disables Task Manager via registry modification

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2