Extracted

• • Target
    New purchase.exe
  • Size 607KB
  • SHA256 e5296213a3d3833fed7adb811b7301e623e0a89011e5adcebf9cc7d387fdbaea
  • MD5 6fc7d6ec865c4287c509d8df254e8029
  • SHA1 960f06ff505e886b6d31388f2afa5459f1a80bd9
  • SHA512 9297e42245e0f40d611469da57aa8ec7008b296fdefa51942fa6836ab03959ea2742560d14e3f9f3fbe06867a8ae3b2369d22bdf3ffb1e08ec560c3bc764fb79
  • SSDEEP 12288:o9FUjlH5n3lkmQ6EOygR4ANxdGEVVY1J/OOeIGUBd8Q+0xVGVm4fd:o9ajVJ3amZnTRhNxdGEVVYXOONX6VN
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  collectiondefense_evasiondiscoveryevasionexecutionvipkeyloggerkeyloggerstealertrojan

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Disables Task Manager via registry modification

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2