Extracted

• • Target

    MAWB,CI and PL.exe

  • Size

    661KB

  • MD5

    2119b4c15a036b7e407a7483a89ecdbf

  • SHA1

    37c3c28bba3f2482e92b3b0ef570c2ba6f3167a8

  • SHA256

    66c79a5e56a0b28126534ded1e9dd50e2de460fb671c49e7cf7a365568c7067b

  • SHA512

    0dc2fbec1eed5cde2bf221c4b95a8cf232fcc922ff8b791cef8b4e816f7bccb1ee3c7b4510fc7aa78a74052dbd5694e1ce3ed55765ba8d1358529b9371829c0b

  • SSDEEP

    12288:2XJ/BQ9wbOEvCJhy5aFj0MbS9ytLF9vVSaQ5X5X8LfH8+C7uPgITpm:8/rOuCJMyJu9ytBfaM8aPgITpm

  Score

  10^/10

  discoveryexecutionvipkeyloggercollectionkeyloggerstealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Accesses Microsoft Outlook profiles

    collection

  • Blocklisted process makes network request

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2