Extracted

• • Target

    JUSTIFICANTEPAGOFRASNOVIEMBRE2024.exe

  • Size

    580KB

  • MD5

    d344b966541bacdcd4e8df8487b8e5e9

  • SHA1

    1e3d2286ede527fe7662c4fba9f2534c3ee129ef

  • SHA256

    ebac7c8cd5045f76ed8f27f50eaa9c1734560bf4d9b398d81ab0ccd1c5af9e49

  • SHA512

    c38716e6196505b83d5111ad1916f3efd13a60084eb7c123552b6c0ee68e0ec93e6219e58818272653c4c6ef178c502a62cf6c9ae31b211924d0c8c96d4689c1

  • SSDEEP

    12288:1kuicZeIuXpkqtAb/N7sATEc+LKM4LK/mySMpQKz:NicgIDG04An+LKM4LjGnz

  Score

  10^/10

  discoveryexecutionvipkeyloggercollectionkeyloggerstealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Accesses Microsoft Outlook profiles

    collection

  • Blocklisted process makes network request

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2