Extracted

• • Target
    eaad1405d982abce9c944768bb64cb756387c3808256ffc1b135b5f85509da7a.exe
  • Size 743KB
  • SHA256 eaad1405d982abce9c944768bb64cb756387c3808256ffc1b135b5f85509da7a
  • MD5 05f1f7e1c965912a07f1253c2de6c2f0
  • SHA1 53bcccc8d9b6b997b755c4df14f8246cb498259c
  • SHA512 e3b43cfba6324779e6354230a6d55f9822867def89bffcf0b17bf3eb9162412a80fff5e599258cbfca46d5ff9f755d33ec31a228c5c441ad0be49e268d0ce548
  • SSDEEP 12288:jxTzU8Xo+g0ixa0AEZQOyGOs61IYZVAecgs9FMa1Mdq8jJD:jxEQDBMljQDGMIYO7MoOD
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  discoveryexecutionvipkeyloggercollectionkeyloggerstealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Accesses Microsoft Outlook profiles

    collection

  • Blocklisted process makes network request

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2
• • Target
    Secundille.Ant
  • Size 55KB
  • SHA256 c09d25505682e7a27603803198bf7610779cfe5989ab260835c5533d3881b25d
  • MD5 662130d89d628f1b333bd1600a467446
  • SHA1 9423949d8d4224998174338465130f55b32e0d6f
  • SHA512 badccd6767ff21cf26e21ad6e18268a5ae8ba23f54c06a59655415536afc36dd19cea877ad7049c0daaf001ab4b925195b279786505f3839491e1ec35d6d6966
  • SSDEEP 1536:A9yjAheHTVzmnnV63aBNE+JZM8vjS6D6vreNc:A9bhezFYxfE+LM2ZDS
  • MD5 SHA1 SHA512 SSDEEP

  Score

  8^/10

  executionpersistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral3behavioral4