Extracted

• • Target
    f67799cd9ce6b4691134db9c85bab1ed79cb17d6b9b805916f118251b0d0f1e8.exe
  • Size 1.0MB
  • SHA256 f67799cd9ce6b4691134db9c85bab1ed79cb17d6b9b805916f118251b0d0f1e8
  • MD5 18faf6be1dcc90f20ae94c45d64edeae
  • SHA1 ef9abc129085039541d7cbad59679bbde93dc420
  • SHA512 c548e772c98b17c0ee30a8662bf84542bbb71d4879d258b833f9d9015f80a9900a05feb8383bb6076ffd2232e739e785b7fb483c993e00496169ebaaf0a86dfa
  • SSDEEP 12288:R5+s4V3yaofUyci8ORr052/6b3mhE+4eNDbRXf9YZSQ73P2/t9AnQ3Z/AklFmp:Os40pfuuN/8N5APRPUrPosK
  • TLSH
    T16A35DF38EB3EFB06D0217A70C829D5F11729FED89949C60ABFD5AD9FB9311520726342
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionvipkeyloggerkeyloggerspywarestealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2