Extracted

• • Target

    ebd24969e4e8a1e0a92c99b14ba34cb5d965fedf8932bf5751299c29c4e2a683.exe

  • Size

    541KB

  • MD5

    8cf95637b0a4e65e6d26c4be890b4cd4

  • SHA1

    11ea6ef1d05cafaa8515808d352243079ebd3dc6

  • SHA256

    ebd24969e4e8a1e0a92c99b14ba34cb5d965fedf8932bf5751299c29c4e2a683

  • SHA512

    d51534385b1028e00cbe74db1b729d0148dba8dcedc140f192fa9515ffd6096c97503d1a492761b7426940bfba945a7146ff89af86c373a5b2d0fa7560e546ae

  • SSDEEP

    12288:1kuicXEt5ggBEhrIPVDedglaOmySMpQKA:NicXEt5rEcND7laDGnA

  Score

  10^/10

  discoveryexecutionvipkeyloggercollectionkeyloggerstealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Accesses Microsoft Outlook profiles

    collection

  • Blocklisted process makes network request

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2