Extracted

• • Target
    secured_stub.ps1
  • Size 1.2MB
  • SHA256 958bdd1130d13562d7bdec171e357d2517b77f10898d1d327d6ce22906614a12
  • MD5 29300e49490dff168e51bb39931dac0b
  • SHA1 2bd4a41da6a79d213f8394e8d3d6ce3112d51db5
  • SHA512 022781dfa894d8c8f894923e163b56d0760801e04da01a7859564b10c700f3b50ddfefa987702ca65eb1de1676f2702f0144e27ebc835968d40d71ad216b2653
  • SSDEEP 24576:n+jgiKBoR2O69KI5H8NysfknX2GubBB1VmEQR:yhh3Id8lfknwUzR
  • TLSH
    T1A845236C6B6D20DD4424A876B9527C50BBDA12D24644171323FC8CFA33F21BA6F7EC56
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionvipkeyloggerkeyloggerstealer

  • Family: VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Accesses Microsoft Outlook profiles

    collection

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • ConfuserEx .NET packer

    Detects ConfuserEx .NET packer.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2