Extracted

Extracted

• • Target
    98d3d28d8ed5c914a3be450d61d663cd23c46f56fc733b5f5c3d8cb82d87ecdc.exe
  • Size 959KB
  • SHA256 98d3d28d8ed5c914a3be450d61d663cd23c46f56fc733b5f5c3d8cb82d87ecdc
  • MD5 0e5615243be67f8a39fb9c91a7a215f5
  • SHA1 f8d4d27fceb919d28b232690673eefd46eaefcc8
  • SHA512 58f0e70225e4da10452c07b693b797a1553c55ffc0e1ba5d25a7e67e363a9edb71b801df8a4a3f421d71e392213674824ba09e300cb9a9cf23300521d8a719d4
  • SSDEEP 12288:Jc9y7hqTXIH7dSgxf2fwTesttkWZxYuCcH46GvmNj3sBsDAPGM9QDH6CsFkkR:JeWU82fcHkWZxYun9sBsDAPGM9Qr6VD
  • TLSH
    T12F251295379DCB22C9D65FF00665D37423B0AEAEF920C3428EEDADE739607062954387
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryevasionexecutionvipkeyloggerkeyloggerstealertrojan

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • SmartAssembly .NET packer

    Detects SmartAssembly .NET packer.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2