Extracted

• • Target

    9c6b53051039e6e3ada670ef5c591e69e3cadae46b3e78510cadb800d2379840

  • Size

    743KB

  • MD5

    e9f5c88ac891da1d0beccbd87d5e019d

  • SHA1

    f967099f11090fb9f8aada10189211c98b777a0d

  • SHA256

    9c6b53051039e6e3ada670ef5c591e69e3cadae46b3e78510cadb800d2379840

  • SHA512

    ebdfe47786bec52aaf399b35a174a05f5840d7897f85de979953b36f1611ebfe47744ab4e74dd77eefbb28525cebd64c8bfe5948ad842460c19907c649dcdb28

  • SSDEEP

    12288:COv5jKhsfoPA+yeVKUCUxP4C902bdRtJJPidw/3SKkypQquMKAWy:Cq5TfcdHj4fmb4a3SKaoR

  Score

  10^/10

  vipkeyloggercollectioncredential_accessdiscoverykeyloggerstealerupx

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2