Extracted

• • Target

    PO-Q01918 200X150.exe

  • Size

    557KB

  • MD5

    10af7f586190bc8a4de0850d39975e68

  • SHA1

    77c03f9e53c6fe5b7972741766bcae5c8be022c7

  • SHA256

    0ae1e00bec56390e433869331168026ba022944634003a790324d48ebb129673

  • SHA512

    3117d1e30c6623120815447dfd81f61f00e04e1703a693c21777aa1007908ea45815ccfe47a74df372454f2e9dd284bbf062faa09afb9da6a7e735212946cba3

  • SSDEEP

    12288:1kuicmiSkWUG1iUOFYTqB91HhVs3mySMpQKA:NicmdktG0nYQ1HtGnA

  Score

  10^/10

  discoveryexecutionvipkeyloggercollectionkeyloggerstealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Accesses Microsoft Outlook profiles

    collection

  • Blocklisted process makes network request

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2