Extracted

• • Target

    da85554e3c6fd23f810647a7582c78d58974db8ddb5b4eefae2d64471abffe2a.exe

  • Size

    1.2MB

  • MD5

    f120c384fe8c2297e69702d53a43d7dc

  • SHA1

    814cf605707f7c41cc18afcd77749b5be39d292d

  • SHA256

    da85554e3c6fd23f810647a7582c78d58974db8ddb5b4eefae2d64471abffe2a

  • SHA512

    714bfc4f2abc589fea6fd63b0a9a013278868d22f50f8b6f17933936f8d900fb522937686da0ce88257a9e098fd4da48ab2e3248a5f56b7a5dfd41c4fa634113

  • SSDEEP

    24576:ffmMv6Ckr7Mny5QLaeUk56Nbv7CrMVwCiMH1mc:f3v+7/5QLaI561cMOCiMMc

  Score

  10^/10

  vipkeyloggercollectiondiscoverykeyloggerstealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2