Extracted

• • Target

    客户退款申请表-SUPERLEON NOVIEMBR.exe

  • Size

    788KB

  • MD5

    39550a5532af152df27a096508a0d4e2

  • SHA1

    45317173c2771b28460dc4a473c2532983977de1

  • SHA256

    41b359e55e25d9f92e6f4ea1b88b3cfe7c6ca962075a60ac9417548ad190c41e

  • SHA512

    e4295d86586abd85284e43a7ce1a726f2ea3caa7e55699d9f2c70d72883dc31e6c6a0b2c6506b986f99911109ea42ee94a4a02e09cdc0e26591aad55f336a866

  • SSDEEP

    12288:pe8o3x64EvUa/AWpUyqVMjmtEatY9j4WT2jwl4TODIY703VBJ8k5bCqU:peRx5Ev9VpU5xh7wOqsY7G8kAqU

  Score

  10^/10

  discoveryexecutionvipkeyloggercollectionkeyloggerstealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Accesses Microsoft Outlook profiles

    collection

  • Blocklisted process makes network request

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2