Extracted

• • Target
    RFQ S04-SQ26050120.exe
  • Size 968KB
  • SHA256 e463f87a0c098ff8bcbc4c262e9eddf3dea51148d2ba9d12c64addb21e2ff978
  • MD5 dbea99565e29b2f1f39892ce2855ec73
  • SHA1 be549d82dc39e2d0733c9b40dbf8bb0949494834
  • SHA512 e6ab04dd9322cf72493f9da09b0bc9dccc0353e0d296660b0476117e7a5bae927433e258af9863021969450ccd237e1c2951a959c6ff3da0818730972a32e35a
  • SSDEEP 12288:cZIrKemgnnPWlYrriBjvvvTqagWQyA50UC/u3Xg/ATDnFMEzWRB55MYZLb0HT0M7:uIbmJlOi3yWM0xuKAtMYavOgVnTW7
  • TLSH
    T16F2512681663D517C99003358E71F7B816BD1FCEF842E157AFE8AD9FB62BB081C18192
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionvipkeyloggerkeyloggerpersistencespywarestealer

  • Family: VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2