Extracted

• • Target

    PO 5986.exe

  • Size

    1.4MB

  • MD5

    8aa0f8af4e622539b7ef1ca4ecd5c854

  • SHA1

    717c962a351e1eb42152e7bed863c3b9282c5773

  • SHA256

    e0092c676baa6a82e979fa3cc3e71d73abb09bfbd98b2948ac427006bfd0de9e

  • SHA512

    009166a6b0ef762b4e05fa5e8a35300b01f4bae1b1056d922ee0cd781e428485639dd7fd2a7d9cb43ee163e9faa53c4da319b600935d72bc6be29449890b65d5

  • SSDEEP

    24576:4qDEvCTbMWu7rQYlBQcBiT6rprG8arVXlzAhw4ryI9vLwlzU92XxhDUKe2Xl:4TvC/MTQYxsWR7arVXpotLJ2BTh

  Score

  10^/10

  vipkeyloggercollectiondiscoverykeyloggerstealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2