Extracted

• • Target
    SM-0230- J - TOOL 10 DEGREE FOR DWT MACHINE-MF5i.exe
  • Size 734KB
  • SHA256 383d758b111ebf7255078b12d04f9f0e39ea4f85733563344754cbaad4bf0581
  • MD5 e7ebd3de4bcba42feee0d2bd98521920
  • SHA1 71608b8fd542467e554766de37cdc8244c84286f
  • SHA512 8810494095ec08538084adc8c788795fa864c8d14a3cb764f6eb31164911c007b1a1c4faec69426dcf348ad9cc9ca38a786376ad9a5d2ee3b527c50588ab2c32
  • SSDEEP 12288:OLAv+r2OUwOGrtWhAefluH10OkBUEdJ240xvahGuY6o/iv6kqYd/l7EsEh32vA6:gK+y7wOOtzeA0hp9uYGP/6DzvA6
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  vipkeyloggerdiscoverykeyloggerstealercollectionspyware

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2
• • Target
    $PLUGINSDIR/System.dll
  • Size 11KB
  • SHA256 fda0018ab182ac6025d2fc9a2efcce3745d1da21ce5141859f8286cf319a52ce
  • MD5 4d3b19a81bd51f8ce44b93643a4e3a99
  • SHA1 35f8b00e85577b014080df98bd2c378351d9b3e9
  • SHA512 b2ba9c961c0e1617f802990587a9000979ab5cc493ae2f8ca852eb43eeaf24916b0b29057dbff7d41a1797dfb2dce3db41990e8639b8f205771dbec3fd80f622
  • SSDEEP 192:BPtkumJX7zB22kGwfy0mtVgkCPOse1un:u702k5qpdseQn
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10

  discovery
  behavioral3behavioral4