Extracted

• • Target

    583fce037fd80a28ebd3dd07cc5ffd8bd89399040587d0a803c22fb33cdbf320.exe

  • Size

    814KB

  • MD5

    ec21b21135f4df1909589fd2318ead8a

  • SHA1

    e914779d6cbd9c693c39c0fb903d55810688be08

  • SHA256

    583fce037fd80a28ebd3dd07cc5ffd8bd89399040587d0a803c22fb33cdbf320

  • SHA512

    33760b9fc2457f450fbc95b148697d18c06d4515ed0ea184efa7be0f433e6054f332bbde19ba5978307240f2a1e4236a33495a9a345b20f703f93f7122f4fa74

  • SSDEEP

    24576:jvYV0HT73uFB1vuQoj5RvdulhTzGB/bNlVC7/:cOzaYQmZ5FNlVQ

  Score

  10^/10

  vipkeyloggerdiscoverykeyloggerpersistencestealercollectionspyware

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2