Extracted

• • Target
    de49bded1f27314b6ac58c61a6e6ebf13fe4e343a7005b32f67b0389984db8ee.exe
  • Size 1.2MB
  • SHA256 de49bded1f27314b6ac58c61a6e6ebf13fe4e343a7005b32f67b0389984db8ee
  • MD5 1783551a3573c859184e25f93918650e
  • SHA1 dd82f5e39e1e415cacc4600cb8fc660b55cc24a9
  • SHA512 ef6c0e303b35178733b86d42359d8063d1008e471921430915178bbe2469c8ba42ee6c4cc8a48542de40fcc6b34285d8a20c394b67664c682ce514f5c62ef94d
  • SSDEEP 12288:0Qu6mToqpEGQoU+eWmY2yPUfvKF6VY2cggwR8zYrCBe1JhMTB1jvRlRLY305CsGv:BubEdkUfG6TcggU+BO+1jplRLYPB
  • TLSH
    T15E45CFAC3111759FC457DD718DA4AC74AB206CBB931BD20396D30DABBA0E596EE042F3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionvipkeyloggerkeyloggerpersistencespywarestealer

  • Family: VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2