Extracted

• • Target

    b5549394c008d733a18e56372657928c92c48ee935402472184965581da3d8d1

  • Size

    1.6MB

  • MD5

    7e6bb0d23284faac75536fa4129331c1

  • SHA1

    f3f2d718162646c494daf44daee88c822146fff9

  • SHA256

    b5549394c008d733a18e56372657928c92c48ee935402472184965581da3d8d1

  • SHA512

    9aefe5830ad266d974ca8b8f7da64444ea406970ed7febebb5d5d9a17545a0c82f1758a95758852aad095c9b795a39645531b2fd25cbae341ab5de8c3a3ef580

  • SSDEEP

    12288:ZvbxYB8F+ZBPHBjcx68ewOHWHvjaNrBpONhzV/aWN8euhklD:lxUy+LPVv8vKWbVdLRt

  Score

  10^/10

  vipkeyloggercollectioncredential_accessdiscoverykeyloggerstealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2