Extracted

• • Target

    Order number HMFZ0772 [Order].exe

  • Size

    1.1MB

  • MD5

    78c45c7d85e31f89c0b94b87aab6b028

  • SHA1

    f8610d277ed728f14caa1c3ef7ab217ead575784

  • SHA256

    7f48076ece325af70637b49f6b629f01969aa805bbfc1b50a66f6692dceb58c3

  • SHA512

    23ab12c6acb6815ff9844968f58abaef3244edd1a254a9690d26a00a95c524c6a98c874293797ee57f2bda6b71c77246820ce770da72ca6a8084ecdc33c51b2b

  • SSDEEP

    24576:pqDEvCTbMWu7rQYlBQcBiT6rprG8aO0vF9YgdsQWv:pTvC/MTQYxsWR7aO0vvu

  Score

  10^/10

  vipkeyloggercollectioncredential_accessdiscoverykeyloggerstealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2