Extracted

• • Target

    516aab17b323ffdf53c58f6994996c75e8f4adec9228738dd028214e66a23569.exe

  • Size

    1.2MB

  • MD5

    ffec9c9515faec6b4847647f37a6a48d

  • SHA1

    0fb40accfcb8a52f642dce7859bf84be6f558537

  • SHA256

    516aab17b323ffdf53c58f6994996c75e8f4adec9228738dd028214e66a23569

  • SHA512

    eb8960dee79a5800d33115151733c90dd9283a9e5d929ebc998cc414a64e00efc68d928c36cc30f6574c3753bd4ae7fb2e89723ebc0824ed88b23f84eb147b18

  • SSDEEP

    24576:ffmMv6Ckr7Mny5QL3id2ew/YxFlrK1fO9iD2bpEfkW:f3v+7/5QL3iMvFZD2b6kW

  Score

  10^/10

  vipkeyloggercollectiondiscoveryevasionkeyloggerstealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Disables Task Manager via registry modification

    evasion

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2