Extracted

• • Target

    QUOTATION_AUGQTRA071244úPDF.scr.exe

  • Size

    1.6MB

  • MD5

    85353cd58ce1fd6aeb033dbaa95fe17d

  • SHA1

    c18eaee8cdea9607491ae77e722d0976dcdfc079

  • SHA256

    6c1748ec0692f3a7fff9fe45083a5267dc700a8384581b0303a52904f6995013

  • SHA512

    b1d1ad7158849e4d03c18d0f10c4a7fc2fe9ad4c4542eec5002cc04b8b77697eaefe11df2dc2bec547eb217d38510447fd452728c4465821e9df547d00d588dd

  • SSDEEP

    24576:ysAAc5cDkdFvoccVq+jCADs3jaUSyjzBpLtMfAOa6HXY04H444l:3A3wkHvocoq0CO8eu/TOLasY04H444l

  Score

  10^/10

  vipkeyloggercollectiondiscoverykeyloggerstealer

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2