Extracted

Extracted

• • Target
    ARIZONA GROUP PO_017633180924.exe
  • Size 1.2MB
  • SHA256 f1d325756041ecfd5cca318a0417b500742b3376a4304db3c20bd915519d35c5
  • MD5 688e2492e092999c00edcf87d5510bdc
  • SHA1 289b35bed288b531890e8093cf7b04a01eed2d30
  • SHA512 84fa057e10b8de8a27db3251e0cfe6356b1a85285c0f019b2ef7c94bc80eecab4c000527336de3a74ad9acec729f3ce75e3a6d0988a12f73fe8c1258f8c0ea11
  • SSDEEP 24576:uRmJkcoQricOIQxiZY1iaCT7epmdVpIw0rZXuw4BAUfc1cA:7JZoQrbTFZY1iaCndVO4DXfc1F
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  vipkeyloggercollectioncredential_accessdiscoverykeyloggerstealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2