Extracted

• • Target

    edc39ad29410ede2deca9aa587fe2e35f0818003447ae608569f7de264959d11N

  • Size

    1.3MB

  • MD5

    6dddf5c4823bc73c25d04605626fbad0

  • SHA1

    c1a6bad0bd35de4ccaf70337ea697e92f9ff8fa2

  • SHA256

    edc39ad29410ede2deca9aa587fe2e35f0818003447ae608569f7de264959d11

  • SHA512

    1939d94219c8782d5269159050f18e151da07ff6a4d84c2463c015b731e680b501209f40cab48cc7d56940a1c23ad7ab6fb0032e475a37ff42efd3e6c3f5968f

  • SSDEEP

    24576:+qDEvCTbMWu7rQYlBQcBiT6rprG8asH1I5+5QkhOH1o81c5rjD:+TvC/MTQYxsWR7asVI5++kIqku

  Score

  10^/10

  vipkeyloggercollectiondiscoverykeyloggerstealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2