Extracted

• • Target
    RF_DHL KULI500796821.PDF.exe
  • Size 747KB
  • SHA256 a4f9afdb0335a81fbca040cbebd5a514e1e11d668022048823e465b4c752793d
  • MD5 27950496141d3583eafb12c7b42ac9a5
  • SHA1 708989cb471cf641b34587ac22c110585aeaae76
  • SHA512 dbfd85fe83a6cb45823305d63286fd15f6b9dce76d4705bfcd30c73510a683b7f414882c147e4f9928bd52398de5a47010f9a09a02a90931aa8f8ec91a7a3f4e
  • SSDEEP 12288:MMykhMOoltiJVv+64qYAJS6FQHRJqc2pis3+m9QXM88Ut7hSLTZ87kR:nykh5oDiJkQZG8piqmXM8bhSR5
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  vipkeyloggercollectiondiscoverykeyloggerspywarestealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2