Extracted

• • Target

    Factura nºB-2542.exe

  • Size

    756KB

  • MD5

    b9e133e3f5e083f026c072086b882fcb

  • SHA1

    a731da15a426dd88896925bf24d63326a4c4a111

  • SHA256

    8a200d76ee514afb1f98399c12bdd0f03fd9f75cbbaff97c67085c6eacbc7ea2

  • SHA512

    300ad4a6a2d53a16d0b946fe2ae1485ac9f45537b0faa394126d304a5b749f7869b416ef56b9361f03546de2bb0962955968191e0ce777a3526de0454bd808b9

  • SSDEEP

    12288:Y2+nSPz5ZA/EME8j5i5jgRufqrr/raUO86cO2jjAQSEcN/rHFu4:ioz5W/EJHj0EGjSEcu4

  Score

  10^/10

  vipkeyloggercollectiondiscoverykeyloggerspywarestealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2