Extracted

• • Target
    NOA-01PKG0644268.bat
  • Size 1.0MB
  • SHA256 e8c9f5cddf123d26d354781b326777146c309559d5a7a5b9d38d2a441e961dec
  • MD5 1afbc6f21ed392eda9f84f8a74c9f50a
  • SHA1 0e7f9ca1193c23e154e94c800231f9fa851fef16
  • SHA512 a78580d14beeb34a0868025a26f533afc761a67511b7acf5a9129e9d5f0499ac9e215b9cf30358d8bc1933d7ad377b70f992c271f9e37b8118932f5a36f0f786
  • SSDEEP 24576:M3p50lQ9iyQjNKgSZm1h+IsuLh34Y7VoDBMob1:8pL9i9zh+Is8hHVQBj1
  • TLSH
    T149350154232ACA01E0E687FAB860D33433A51ECF78E2D3D69FE65FF778293811954592
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionvipkeyloggerkeyloggerpersistencestealercollection

  • Family: VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2