Extracted

• • Target

    SWIFTCOPY024172700818106527.exe

  • Size

    1.2MB

  • MD5

    9f98b5b61abeb0c43283d74ef3ab6f93

  • SHA1

    a640e1143888ed1a8e14e95b1b40c0818b6150c5

  • SHA256

    21a59a11cf82fabbd93b0df668a88f1af5e8fc17579439510d38cd30f9436e91

  • SHA512

    104e29b9c3d01c30eee97580a9204804bea039346bd65626afbaf541df54e107974ad119574519ee7fc035fef04657789f5886c5d2a85cb4c51d3fa82f219c72

  • SSDEEP

    24576:ffmMv6Ckr7Mny5QLFDd12e/16UYhBwpxxWqWXlYIcW8530a:f3v+7/5QLVd4e/HWwX6XlMJV

  Score

  10^/10

  vipkeyloggercollectiondiscoverykeyloggerstealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2