Extracted

• • Target
    FACTURA Nº A 178 CASES XALÓ S.L Nº 17102024 REFª MARQUESINA MOLÍ DEL GINER.exe
  • Size 823KB
  • SHA256 24de759c141ec60a2d89352e581ccc47b83d0240702283903e8cbdd1d9745265
  • MD5 e094f4ca0bcf4795c43c37b71cd65001
  • SHA1 dbe62e4ab2ba669fc5670b2aacbefca1784798f4
  • SHA512 40d8df1697890ad77cbe6bb4e47cd111890b4ed4f99abbd984dc0341b006ec947c0af37e951852a2fa32c8562e1085060a1e14d677461ef2a773ba88f92696fb
  • SSDEEP 24576:vbDc7+6xit+u3UjQqNATwJe9YESd4+/dD+la:vbDcUxOSBdSd4XM
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  vipkeyloggerdiscoverykeyloggerstealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Loads dropped DLL

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2
• • Target
    $PLUGINSDIR/System.dll
  • Size 11KB
  • SHA256 5a1c20a3e2e2eb182976977669f2c5d9f3104477e98f74d69d2434e79b92fdc3
  • MD5 7399323923e3946fe9140132ac388132
  • SHA1 728257d06c452449b1241769b459f091aabcffc5
  • SHA512 d6f28ba761351f374ae007c780be27758aea7b9f998e2a88a542eede459d18700adffe71abcb52b8a8c00695efb7ccc280175b5eeb57ca9a645542edfabb64f1
  • SSDEEP 192:eF2HS5ih/7i00dWz9T7PH6lOFcQMI5+Vw+bPFomi7dJWsP:rSUmlw9T7DmnI5+N273FP
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10

  discovery
  behavioral3behavioral4