Extracted

• • Target
    gbIM8JUazFGEAPH.exe
  • Size 735KB
  • SHA256 0d41bec1e1df871d2a73908ea7f03498e78f8f75a65e87a7d863e333e1d4e65f
  • MD5 3188799f2f93494613a630a20bceb760
  • SHA1 2534228f9ad8a48eb44654e747a0c97877f38006
  • SHA512 d4377fd6f803ca70abbb9cd3c8f75acef1a18f08cc28ddef8cbc1f353b6cfbd6c10180a147fd130c21843136fe022663f1193083e4758fbb21e841aff153832e
  • SSDEEP 12288:ksjZm3qxUwQD3QzWcqUhXwFrZ2Ji6W8JEKabGPmx2OuztIEgK4C8YJcoXcTZwNp:kVOU18nXIryi6W8J1kG+JDscoXc+
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  collectiondiscoveryexecutionvipkeyloggerkeyloggerspywarestealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1