Extracted

• • Target

    PIT87678900098000.scr

  • Size

    807KB

  • MD5

    c225921062cb8749387cd03c7cf1486a

  • SHA1

    2f5f025d3d77a7b7282e5a3e72810164a9b5966d

  • SHA256

    84943f07b991e0b13893e5d9f5795d1e7a70a486318c5106a0fee6fed67904c5

  • SHA512

    1757e73549dd61897e47ecb7e5e879e1f48f0623c57b1ccff7cfc1999e90ad21b65848f9fa2e6fb67964177f045be0755179c37c9ab87274fb80d26b0a8d49fe

  • SSDEEP

    24576:tthEVaPqLxA5nG0QeJAVR/YhipCPTO3VzKNH:VEVUcq5GJooAhMfwNH

  Score

  10^/10

  vipkeyloggercollectiondiscoverykeyloggerstealerupx

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2