Extracted

• • Target

    New Order Inquiry Maiden Med Sept 2024 #287772.exe

  • Size

    769KB

  • MD5

    c647aab9bb0c4b04a5d15c5d5b4ca4ee

  • SHA1

    b94ba0911d7f3addbd1a262de11df13096bb51c4

  • SHA256

    eaf84feb50c9fb9957f022597cccf2e343e04fbde288838e64c4fd6513301289

  • SHA512

    c0179b98f3b2e40d698a4c408068308c312e026eb5d1f590b0120cb7368761c7a2a2195fb72d252c3d9bc4d41d9ddf9aa717dd3299b191038118a525f102ae1d

  • SSDEEP

    12288:unU1UoIG5MPUwBZiAhmug2hF3evSXAF1i1GbnPg82bTGEkJ42qWQ2gi7nWI58wXY:zUobyZdhF3eyAXbUGhkynztlXJbga

  Score

  10^/10

  vipkeyloggercollectioncredential_accessdiscoverykeyloggerstealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2