Extracted

• • Target
    HKB09876560.bat.exe
  • Size 833KB
  • SHA256 1a56264052af72a512ad3e6d9a1f5eae72f07be03109ea14dee0646afb77e3a2
  • MD5 8324a23634f8358983e62e4dfc405bb5
  • SHA1 71de4c6e11a5f615f8f00b08b39333fa31ce9af7
  • SHA512 8c4c49dc03366d8fd789aed5415f968009fc9904a67eba98afcc76ab5d5c37e59dc977f91d6cf1d9760ae40b35bc54100c5d3901aca59e0946b5b08f0bc23e1c
  • SSDEEP 12288:0nhmztIp1HhzlXxz5jXybsqHia2nqEM2unpiFPUeTobgoAGCgJGnc:0MoBzlXxFTq1nE3Lo0GdJGnc
  • TLSH
    T1AD05D04632509603C925BFB70533E67443AAAD99B420E1064EDF7DEB7A73B43192728F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionvipkeyloggerkeyloggerstealer

  • Family: VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2