Extracted

• • Target
    Order SO260717013 signed.exe
  • Size 968KB
  • SHA256 503fc457229a73025bb9cd34570cbaa534a7c2f9399349008abed8c3a1136a5f
  • MD5 133a879f69fe9ebdb16609d8e404064f
  • SHA1 97a4a0d3cca1b8ff312fb4c20e9fc96c4d9b96d3
  • SHA512 da5bb538b7ff2842665b7b757a6adf206f04c9132224c6020fb65fbaf7b416d1b4095336ad68de8c512d7d02407a8af454f8d661b1ce0a7c68054ee5275fd785
  • SSDEEP 12288:mqrYBq99gI4Rejw/4w+8LLNK/M3tHhbEb1XTyTcMgYQTeiZS1UHxfje7yvz0lFtG:FYa9V4HgrxXeQTNZSGIIzq5a
  • TLSH
    T187252314A748C623D09FABB50D50F23147E95DCFE665C708BFEA9DD33EA62702121782
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionvipkeyloggerkeyloggerpersistencestealer

  • Family: VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2