Extracted

• • Target

    c46baa7cd710456d6f6a990295e929d62305036cc1592508ecea040a7bd3eb5b.exe

  • Size

    763KB

  • MD5

    99be54eef515e3bb933f1b7fe2746e7d

  • SHA1

    2c5351daf0d3f6d86541bf432680cab4b284f72d

  • SHA256

    c46baa7cd710456d6f6a990295e929d62305036cc1592508ecea040a7bd3eb5b

  • SHA512

    41e989c379c8786ebfc1dc02686905e8b407b6fed21763df769321cc158d7b306094e3e613a9928b5447011eecbddde6de2c8e11777fcf7b66016746c418cad5

  • SSDEEP

    12288:pe8o3x64EHoJffn6KZyztqIjP7pFbJAmhxnODIY703VBJ8k5bCqR:peRx5EIJHn6QyzfTFDAmhxOsY7G8kAqR

  Score

  10^/10

  discoveryexecutionvipkeyloggercollectionkeyloggerstealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Accesses Microsoft Outlook profiles

    collection

  • Blocklisted process makes network request

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2