Extracted

Extracted

• • Target

    OrderList.scr

  • Size

    785KB

  • MD5

    8d46e55973af1de9d60320eab1ea1fa2

  • SHA1

    2b6e1e250f5601308ab09a8a5f5ad78b78c33985

  • SHA256

    86865a4fa894a64051e0bd9134851d148576c2fc3b49e0621fb04553bb5632f5

  • SHA512

    b51f517918b9b98a6d1720a73f02401e47bc4e9459ae316fcfdaa9eac300dfe873b6d775fb01f53fbd5547352de265a52d95700dc5470d604b1b2bb23840f029

  • SSDEEP

    12288:rLkcoxg7v3qnC11ErwIhh0F4qwUgUny5QLtkxixMXdqLGU1gzf:ffmMv6Ckr7Mny5QLtk4xMNqFgzf

  Score

  10^/10

  vipkeyloggercollectiondiscoverykeyloggerstealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    Quotation.scr

  • Size

    945KB

  • MD5

    91808cc12b1db334c458e38174207aba

  • SHA1

    6a7be345db82c710c129b7bf17a9633b92398482

  • SHA256

    2b68138198f01ca60ce18eb72fc8c1268691bae2409dd56ab871d465a958c1dc

  • SHA512

    771784a96c5bff6fd6ebca728aa634363bf5a13a8e0f907bb76524bfa8f4131e5aef1ed680604ff9131d4c6588386a9b2758f1b0501c9bd9484d645a3982a1ed

  • SSDEEP

    12288:Jtb20Qc3lT7af41ePBRYuQLKpqeUhbTv5OFgNuPPpHSga5TiSRlHEKqEFJMr+6A:Jtb20pkaCqT5TBWgNQ7a9iS3EVE++6A

  Score

  10^/10

  xwormdiscoveryrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral3behavioral4