Extracted

• • Target

    e918f19d7627b7fa623f669351f2e00e029fa71bf08082c527da5b88ec53b9dc.exe

  • Size

    2.3MB

  • MD5

    1e9dc5041bf503cb63397e6a8f0bae9a

  • SHA1

    9d21fe92ee433be3be4c09f8d242b4ad87d2158c

  • SHA256

    e918f19d7627b7fa623f669351f2e00e029fa71bf08082c527da5b88ec53b9dc

  • SHA512

    d377b79a8220426eafafac5a9e9faaf8dc556dbf0ac545e485ecee2d3bdab6100eee6416c104db8f6c847d5672f2cff92612ad989a8fcf36f147c357db100cbb

  • SSDEEP

    24576:wLQ4ptMQJ/FlikzQjbrf5k+OhMAYg+BFe73DXiAeBHYGnUjkuxx/d//6e:w7lCbrRkHhMRTi3DXiAJeUndH

  Score

  10^/10

  discoverypersistencevipkeyloggercollectionkeyloggerstealer

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2