Extracted

Extracted

• • Target
    0e1ea2bee6ebd3ca2bbcaa814faaddf1d6dc53bf81e2695a609a8f45ceffda9d.exe
  • Size 1.2MB
  • SHA256 0e1ea2bee6ebd3ca2bbcaa814faaddf1d6dc53bf81e2695a609a8f45ceffda9d
  • MD5 c22e015dc60dcb8accb6252bca1c44d0
  • SHA1 271b585e8c2c8da6b4f3620064699e684743504f
  • SHA512 6d11cf8a85f6d8f139b1b47945aa1eec1664d0308ee740c8ff018132f929a51779abe7fca4b92aef72d7638e0f7078df4c498630eb42c1c67de90f3d915141ab
  • SSDEEP 24576:G1WL0pduhnIuEXYphVUVAir/X2jAA33Ea49dV4cNbLE9pJyoQXcx:GhpEIuTi/mjNnOv4ebQ9ycx
  • TLSH
    T177451204279CCA40D89257F00AB0E7762BF5AE9EB821C71B0EFE7DEB34617A55844787
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryevasionexecutionvipkeyloggerkeyloggerstealertrojan

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • SmartAssembly .NET packer

    Detects SmartAssembly .NET packer.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2