Extracted

• • Target
    80fec3abccd1b92402ee722616dff2605fd5132d9b208d5069c47389247de6dd.exe
  • Size 738KB
  • SHA256 80fec3abccd1b92402ee722616dff2605fd5132d9b208d5069c47389247de6dd
  • MD5 2b0402915579ce1debc2f6cc55695b78
  • SHA1 95ef25a88cb77e153984d8cc84f5fcbd9dbf764d
  • SHA512 90d9770e6d241c6cd91d061e04bb48ad56ecbc271b115bb5a2b030d47397400aae42287954e0fa08da88b266264c419e2aee49231af0cc3966c8381463e00862
  • SSDEEP 12288:j/En283Cjdq2aXAv2zOLAJMrETpq9dXOyGOs61IYZVAecgs9FMa1Mdq8jJA:jM2gCy42qLAJeETpqDGMIYO7MoOA
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  discoveryexecutionvipkeyloggercollectionkeyloggerstealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Accesses Microsoft Outlook profiles

    collection

  • Blocklisted process makes network request

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2
• • Target
    Chymes.Ari
  • Size 51KB
  • SHA256 ec27c4d9af6cbacd93b645c053a5f4395c8c681e40fc203efd78fd139ed45c82
  • MD5 c44effc2e31c09744797d777080d6f2e
  • SHA1 8828388bd410c357e6b97cab00bb61519195f824
  • SHA512 2f40b4211743380d4126749b98e99301a879ebed0fc2d811d39c1c674ae2a0961d7a2044aa8755221e34617c482c83b444e3c54e9823de0688eec3f4a712e203
  • SSDEEP 1536:0MvcHJCJBjaqb4Dwjfrfo4zajOJRmaEgUys/Qarn:0M2KBr8DWrw0ajO/ma6y4QE
  • MD5 SHA1 SHA512 SSDEEP

  Score

  8^/10

  executionpersistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral3behavioral4