Extracted

• • Target
    IL SHIN_PAYMENT_APR2026.pdf,IL SHIN_MAY0126.pdf.exe
  • Size 1.1MB
  • SHA256 ce49754955c7bd3656beea94b2197119ddb00ba1aa3420d05b98c744006c40c9
  • MD5 f9fac49c847b43577d82a62adea404f1
  • SHA1 df4f9128926cbffcf750aa80672511cac6d50312
  • SHA512 873ce93d8476f6ce0f4e488ad4bc038002696f63b6e0b319743c40b4920da7e076b113735ee66fa184c82caa80d1c48656188c8270f7588744e147b3f8db1e2c
  • SSDEEP 24576:CzZ5Jp73Z0Gm7Ys8QQLpdTQEVNuZGg9W/ZqIZ8Ij:CV5JX0jEBBLfQEIGuWhvZ8Ij
  • TLSH
    T1073512082219CA03C4A64FF41971E2F81B745EDDE502D707EFD97FEBB8796811A8528B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionvipkeyloggerkeyloggerpersistencespywarestealer

  • Family: VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2