Extracted

Extracted

• • Target
    1eb9e4d9431c70bfd18beb58430bc81724eaff21837dd1faf012c83921a6418b.exe
  • Size 655KB
  • SHA256 1eb9e4d9431c70bfd18beb58430bc81724eaff21837dd1faf012c83921a6418b
  • MD5 4b6574b4f1fcf896e9d945b4ee9edbe6
  • SHA1 4fa67c8e5c345c5a75ee4c99562119ea1bf89603
  • SHA512 949903450ce69ca58a9e90482815be71298d14873726768f4004a2616fc7db66510ece2f155c36d1942dba2ca0b293b211b2aba5562e15847a895bacd8796d7b
  • SSDEEP 12288:y2QJ9o2sW3B9o2G2/6Skw3HhBLVBqCFENom/8Jdbt/dAhyWjX53XOTb:yv9o2sW3B9oV2iSkw3HJB87wdhyhyaRQ
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  discoveryexecutionvipkeyloggercollectionkeyloggerstealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Accesses Microsoft Outlook profiles

    collection

  • Blocklisted process makes network request

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2
• • Target
    Bronchial.Rev
  • Size 53KB
  • SHA256 07214c3106b73ab3636312bb5dded94558e94ff987c2a7afd3b25d6f6ff70603
  • MD5 964ad8a70ae8d0d1460e36109c9e717c
  • SHA1 c6c17dec132a22c0da128abc21b47793996d9c86
  • SHA512 588dc5d099ded1d86d60b767c851fb8b5aeed8297a3e7d8dec013673e7f576758daa7adacc68e514f4cc5b950795ff1d14162b0996fc5c022512cfac77b39c37
  • SSDEEP 1536:0UQ5eKx/WJHbGssheX5PeqSmH8UdEHCxsewwM:HQ5eKxwHbG8e/q8UuCuxJ
  • MD5 SHA1 SHA512 SSDEEP

  Score

  8^/10

  executionpersistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral3behavioral4