Extracted

• • Target

    Proof Of Payment- Swift Copy.bat

  • Size

    672KB

  • MD5

    39ece2abddd8cd86565c3c4dd83a08f2

  • SHA1

    0b605de9bbda10d8d70759812ec2e90ba128e7a6

  • SHA256

    b147b7f7e30fe740ba8adb0c1b376b5df25a27b59275a41c872f1ee0956415f2

  • SHA512

    5cabb9bea16ff13577cb65ce55d85c561af28396055134c33af5b5fc258381cdf93e0072c1dee1179247fdff8c488e350cf83dbc41e25f6ba1bef8eebaa6cc54

  • SSDEEP

    12288:qr9UEWtpNOoR4XiqzD5634pVGf0mT+x31ETqA+163KzfVrWAhn7aQGNDT9I:UWtpI4SMZTguTq9oWNrWomQGNDm

  Score

  10^/10

  vipkeyloggerdiscoverykeyloggerstealercollectioncredential_accessspyware

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2