Extracted

• • Target

    00ad095c7d7827e12cfdc78f6a50a3a6689127c37cdfb66261411adf04d00c93.exe

  • Size

    860KB

  • MD5

    f271aa903190c8d41e12754b7c84f30b

  • SHA1

    9a95aff593718f7ba6dea78e763d1123d539881b

  • SHA256

    00ad095c7d7827e12cfdc78f6a50a3a6689127c37cdfb66261411adf04d00c93

  • SHA512

    73de497c6839dc4a34891f22b2a38e3cc1fd2a747cba926cbb2cd2b96a6cfb2d700da775995b404be565828c9843625900f5c2dbcaf58e06cc8aa2d8b6dec24c

  • SSDEEP

    12288:ccMv6yXix9GAzQXH4kKCNyEJl8BYQrt6IDlkuaHnZ6/EGV+CsDZ5:ccMvhybGAzQXtKfrYQp6IZkuS+pWZ5

  Score

  10^/10

  vipkeyloggercollectiondiscoverykeyloggerspywarestealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2