Extracted

• • Target
    589ad55861e3bbb4683004dc8fda0bcbc324d8ca56de2c378d565a82b7ab62a3.exe
  • Size 1.1MB
  • SHA256 589ad55861e3bbb4683004dc8fda0bcbc324d8ca56de2c378d565a82b7ab62a3
  • MD5 aae52f58cb15e69bd4297ea2399d2558
  • SHA1 526c4f49242db63abef1bd8a4ac2d9d1847e02fa
  • SHA512 753a8ffef154fb080e5c8c14209105daa835dd6e47c38a782da3c70834043156b472ec9366761438b89baeca182a87ab12f34318f386c63bf6d736df7296c053
  • SSDEEP 24576:kklr+d56HO0vS4NsCMd7Mzifhkvu2D8FEvk:k8+d56u2S8sCMd7Xvs8E
  • TLSH
    T1153501986A1BD903C54547328AE1F17853B88EDDF612E3236FDE7EAB7C27B540C441A2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionvipkeyloggerkeyloggerpersistencestealer

  • Family: VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2