Extracted

• • Target
    gQIEXXQqBL1xisG0ZScug8J7zKz11EAVa-ywmWXRTJI.bin
  • Size 2.3MB
  • SHA256 8102045d742a04bd718ac1b465272e83c27bccacf5d440156bfcb09965d14c92
  • MD5 d820b3c25d6900193269a9e8856e1e0d
  • SHA1 7e1c8372bddccd10e7a978c8536278198573dc8a
  • SHA512 5f329ef635dd602bc44283e4020cde22c0b9ccab114835f0c1e5430d7c0bb87a7e69e832173215f78c5a5a0f4fc4ea4b2e71d3b96bfc079b28eaf6c6cf410ebe
  • SSDEEP 24576:hIvmzHdprcSIV1yGTKBEbhorrD4dBVMoKYqKrGGQFDwWfYPhUSyrXJq2qEvOkYCn:hIYd+4B6qL
  • TLSH
    T111B5C7F137CA3A4B28083A4794AD6A544D56DC01BD43B1D9FCE786895C5ECCA3384EAF
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondefense_evasiondiscoveryexecutionvipkeyloggerkeyloggerstealer

  • Family: VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • ConfuserEx .NET packer

    Detects ConfuserEx .NET packer.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2