Extracted

• • Target
    fa8bed9286024914510fafdfc2eb70dcfe8999f8f768e19b7fa98d64d8035a76.exe
  • Size 1.0MB
  • SHA256 fa8bed9286024914510fafdfc2eb70dcfe8999f8f768e19b7fa98d64d8035a76
  • MD5 d55fa9d4673e6bb17c1becd31b82282b
  • SHA1 ec15121523e8dd0e902082f05b9e14ee76260cbf
  • SHA512 d442b865c23fcd73a9cec1d2a2bfb190f0fcce4dfba1f02f9913499fc96e844306518675dbc9bb26043290f7780182f1bfb5b5fb5a9469362f8543001dbe5adb
  • SSDEEP 24576:qdCe6XA5fFIVDx29KsVAZeDowFs3FiN9Obdgr1Ftt6B:dPaGVDxnmAZekwe3Fm9uur1/t
  • TLSH
    T1DA350104637ACC02E1BA5BB558F2D17503B96E8DE622D1475FD57EDBB632B818AC0383
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionvipkeyloggerkeyloggerspywarestealer

  • Family: VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2