Extracted

Extracted

• • Target
    Snvlerier.exe
  • Size 1.2MB
  • SHA256 6e0230eac8eeadd5214b6d83cc2f470933bee1c4261a607e182a093af14b62cb
  • MD5 9970463edf086976996f0bc196fcfc60
  • SHA1 22f3132f1456dba3bcc7096d2c10c5635ee08828
  • SHA512 bed16bf0f2ad277ac3cf34937e128efbd861472f99c0d1cb36f1bb89f7a5dab64174bc113c707ceee52a2bc39d2546610015edb54c18a076a297ce5ec7d7c7d9
  • SSDEEP 24576:voqqHmQ2mlK1Vq4XYV+EYBU0pD1VHTkXQk9duRUrO0SmJ7GtHufK70y:voZmQ7KVVXzEYBUspQQEuROO0Douf+
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  discoveryexecutionvipkeyloggercollectionkeyloggerstealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Accesses Microsoft Outlook profiles

    collection

  • Blocklisted process makes network request

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2
• • Target
    Eftermles.Tra
  • Size 52KB
  • SHA256 bd0e151a557b61a444bb30970b0ac73cdae213addba8b30f0d04231e59b81d00
  • MD5 0bd036116e386ad4087ee98b7e9b202b
  • SHA1 8fa72b8d7863e783966744a27aa859a01a0f023b
  • SHA512 6b024cc20a52c6e9b853114549d3edc0af400b76f918cd2667653936a51af78e57e0bb41945683e823e85b5a8cf99ff8db290874bb48619610d6530f125269a7
  • SSDEEP 768:iCSkeNeDpS/zxwceiKuHkzJlnBK0VI05dsjQy8wJ1Asd/vqN/5xhSmDC3GER08yZ:gwSOTZG9EstvqHHBFLwgWA8skWakl
  • MD5 SHA1 SHA512 SSDEEP

  Score

  8^/10

  executionpersistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral3behavioral4