Extracted

Extracted

• • Target

    GPL-HQPOHQ242654.exe

  • Size

    1.0MB

  • MD5

    1553c28fa4dceead27570ffd93cc4e34

  • SHA1

    aadf5e0c3cb56f70fe0b528c9514528f3403da9f

  • SHA256

    191b2050bba8e91cad27846a543044c8bb44c1de44e9c43c4ad225afcf1aa3e4

  • SHA512

    f8b2acf801a7bebfc95738a24e8c0c6a7845df571e6859d81520c33b8f5fc442b517efb397bd808d5a9472ddded9cea1dd92a40663ccdbe1c0f079454c7295ab

  • SSDEEP

    12288:xtb20Qc3lT7af41ePBRYuQLKpqeUhbTv5OFgNuPPpHSgal72z+BvARJMN6A:xtb20pkaCqT5TBWgNQ7a5+iKJMN6A

  Score

  10^/10

  vipkeyloggercollectiondiscoverykeyloggerstealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2