Extracted

• • Target

    PRODUCT_LIST.exe

  • Size

    1.3MB

  • MD5

    a11afb56da05277abb60bd8150394e78

  • SHA1

    512771c367a050b4e8baef3318d56731142cfdf5

  • SHA256

    be61fe0450693928b2c2881e4e6540d17a317d50ddb1f1681a9774fb273bdcea

  • SHA512

    1c34927333fc022a4aed64c4f6437c4748be8dd348675d129372c12c8ae7c2adae91d7f7047dd5a077d89b37bc90b7d85d70fe48b69edbe56ebef210fcea0ec5

  • SSDEEP

    24576:pRmJkcoQricOIQxiZY1iaJy0UQh+B8V50smLXuOTx6Uaoar:mJZoQrbTFZY1iaJy0UlB8V50/eZpoo

  Score

  10^/10

  vipkeyloggercollectioncredential_accessdiscoverykeyloggerstealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2