Extracted

• • Target

    details.exe

  • Size

    888KB

  • MD5

    f70021246acc64f8d88a0c914659f0e9

  • SHA1

    2549bb7d63c834f1ca8b6e635354dc2ae28b2676

  • SHA256

    794427424e55ec8a3dad09251c8738de98339fe1ade876ccf80930fd761e158f

  • SHA512

    6ab856933c78ba1da44dd70c2d2d130f4d8bccc136e7057ebf0c282fcb59453316faa861989d497c0e08f6aea7a0a34e3504751a43c4bd616f463997c91e578b

  • SSDEEP

    12288:TvSqYOE5S8uDzrhYC+Cf/lunIpy6/9YUoEsUTJLE83mG4aesE1gqd1twf:OluDas9iEsUTJLEumCedFy

  Score

  10^/10

  vipkeyloggercollectioncredential_accessdiscoverykeyloggerspywarestealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2