Extracted

• • Target

    RFQ 24201007.pdf.scr

  • Size

    6KB

  • MD5

    c3faec92c8d98520e0cdab9ba05d1a3f

  • SHA1

    39a025bf0c0f94a0a269e72700a9f0245a349b36

  • SHA256

    956d35ea5fc53269ca00d84d9f765ca6e7bb33e30eb376c54c94eebc4f5b7ef9

  • SHA512

    183ecac23b10da4bc48cacef135fbc647796b2764804f43f91b5a49b09a0a535d23700afa7d469a816b94206858513c9d0c08fc46eab3075f21b1ea6e12d3dd3

  • SSDEEP

    96:LQAm7EhsIHRpY5J2jRZ4ph5CkN/jo4zNt:cAm7lIxEmRZOh5hp

  Score

  10^/10

  discoveryvipkeyloggercollectionkeyloggerstealer

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2