Extracted

• • Target

    rPaymentswift.exe

  • Size

    1.2MB

  • MD5

    58855b0b731025c138072cbf7a9a2f72

  • SHA1

    1d9a9930f5bb6c48f84268257107717f69f5b97c

  • SHA256

    e86d40009e12b5b38bf503d6b0b3fd0bc05ecadb1c6707744c881a6813e3e4b8

  • SHA512

    853da6e5d7d6e75f760e838d9e9c248f99fc81340e09f61d689a37afec769031656b9c73eed19c78b07cd29ba1b408c06afb538e72ff9b68a29925048393414f

  • SSDEEP

    24576:ffmMv6Ckr7Mny5QLjVDAz5TAqBVbBciFVJdqfb:f3v+7/5QLejifb

  Score

  10^/10

  vipkeyloggercollectiondiscoverykeyloggerstealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2