guloader | d6671c0032650d42dfaccb25d36507764dce6af6e577bcc7125559747be2da97

General

Target
d6671c0032650d42dfaccb25d36507764dce6af6e577bcc7125559747be2da97.exe
Size 552KB
Sample241125-dh42eavnav
SHA256 d6671c0032650d42dfaccb25d36507764dce6af6e577bcc7125559747be2da97
MD5 17cb6775dad970024fc95ec9869edb3f
SHA1 1378dc79c453145e94fdb5e1cfaaf4d40cabd538
SHA512 d0e19ca4a0a7f878a834347d5d4a294de3e83cc4541008f3a8bd28deb6ac87779803261e058de3b1ea51b068bb7e3e8d063dfdcd751220cfea8ff5149168d81d
SSDEEP 12288:32EIH/BAPq+05fmfLQ+1Uk2T2E7Rmd3ZhZZ:3wH+PqJCLQ+SkgpRmdPZZ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

vipkeylogger

C2

https://api.telegram.org/bot5049969282:AAH9uCOswhSYvcxjDJ1p81mZiTgnuLqELhE/sendMessage?chat_id=1398386501

Targets

- Target
  d6671c0032650d42dfaccb25d36507764dce6af6e577bcc7125559747be2da97.exe
- Size 552KB
- SHA256 d6671c0032650d42dfaccb25d36507764dce6af6e577bcc7125559747be2da97
- MD5 17cb6775dad970024fc95ec9869edb3f
- SHA1 1378dc79c453145e94fdb5e1cfaaf4d40cabd538
- SHA512 d0e19ca4a0a7f878a834347d5d4a294de3e83cc4541008f3a8bd28deb6ac87779803261e058de3b1ea51b068bb7e3e8d063dfdcd751220cfea8ff5149168d81d
- SSDEEP 12288:32EIH/BAPq+05fmfLQ+1Uk2T2E7Rmd3ZhZZ:3wH+PqJCLQ+SkgpRmdPZZ
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

guloader vipkeylogger discovery downloader keylogger stealer collection spyware
- Guloader family
  guloader
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- VIPKeylogger
  VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
  stealer keylogger vipkeylogger
- Vipkeylogger family
  vipkeylogger
- Loads dropped DLL
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 a632d74332b3f08f834c732a103dafeb09a540823a2217ca7f49159755e8f1d7
- MD5 75ed96254fbf894e42058062b4b4f0d1
- SHA1 996503f1383b49021eb3427bc28d13b5bbd11977
- SHA512 58174896db81d481947b8745dafe3a02c150f3938bb4543256e8cce1145154e016d481df9fe68dac6d48407c62cbe20753320ebd5fe5e84806d07ce78e0eb0c4
- SSDEEP 192:X24sihno0bW+l97H4GB7QDs91kMtwtobTr4u+QHbazMNHT7dmNIEr:m8vJl97JeoxtN/r3z7YV
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral3 behavioral4