Extracted

Extracted

• • Target
    6e83b0b68d760ee2cefe9d1bba7d58f199f44dea2d729c7c6adbd949846281a3.exe
  • Size 888KB
  • SHA256 6e83b0b68d760ee2cefe9d1bba7d58f199f44dea2d729c7c6adbd949846281a3
  • MD5 a2f467fb06f9d893c40da9ef9a004cd0
  • SHA1 3df7997d42a165ae3ef933ae46fca5bd1ad83567
  • SHA512 b95c2e1f19eb66200aff7425f3bc3b5b53162d8b1544cde29964fd8e8b1e5575b635a51f7a88b0be23d171462748e425745c58526eceb6c0f542a44f6305d6bf
  • SSDEEP 12288:lkw1iNvHH6SZzpX8zm3iGIvQrJfAmr/4ZL2autpn2blySnu4kWzMaXFAyU7OU:lkCKX8+i4rIgautpnulyMu4PrAym
  • TLSH
    T13A15AEAA3AEEC82AF0761F70C5E1F2F247B59D41E611C2078AD57DD73936B80168634B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionvipkeyloggerkeyloggerspywarestealer

  • Family: VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2