Extracted

• • Target
    Requisitions.exe
  • Size 1.0MB
  • SHA256 576a0f67a8fcc0a2e3adb30cb59903699761d9a0d11d95d6620d443f8c625d4e
  • MD5 698dbd0f7705ed93ed8299d1fb4f4e6b
  • SHA1 cf825064935d1a766b7e05a7dd39f1098c4a5f61
  • SHA512 4819129f5faf94165c9e282dd6c56d2fd61c6d2d746bde74db68c97eeae787eec0c3e6e9e1006764d887a5e1df227e068d9b518efd5cec24af34682ea5d26e79
  • SSDEEP 24576:sJp50e5ddE+w2tnTZ/SRwgIxfykURCtXPqoCRgz:CpjLvnuIxqpRQ8A
  • TLSH
    T12D3501552356DD02E1E6C7F6B960D37432A80DCE39E2D3868FEA2FF7742A7C01954682
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionvipkeyloggerkeyloggerpersistencespywarestealer

  • Family: VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2