Extracted

• • Target

    67b5d52591b9f4e140880a8bf61d91917cf462c42f48ad74957b5f530d77c1ed.exe

  • Size

    186KB

  • MD5

    ccfea348135f4b48f198168851a7a8d4

  • SHA1

    69bbc8774953617a32c2689f95e5b146cfd5a681

  • SHA256

    67b5d52591b9f4e140880a8bf61d91917cf462c42f48ad74957b5f530d77c1ed

  • SHA512

    585c3e6c25230dcafa43886375747b7ec04542ca90724b7804889ebcf062cf286684ae20bc4c3c335cd70c218d8ae6c0673df0cbef762abec46f33bff9093089

  • SSDEEP

    3072:X/DuqxP+uGrIqHoRWxeLSE8Rt6dAv6/fP2LeMvtcjVDRy4W4hr9PcwD0A:72HoRW0fCv6/AqVNy4W+g

  Score

  10^/10

  discoveryvipkeyloggercollectionkeyloggerstealer

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2