Extracted

• • Target

    d17b05e32a5fc1c63c16f4e03c290cd7e877e1c1ede63075c431a629ffa8a44b.exe

  • Size

    620KB

  • MD5

    6b10db2cc19d6d1d006b7f7f2086aead

  • SHA1

    a5766a12713c410c6f3f93489cf849397f1aa0c6

  • SHA256

    d17b05e32a5fc1c63c16f4e03c290cd7e877e1c1ede63075c431a629ffa8a44b

  • SHA512

    2d953e678157baa6302a4d81e8c0004e4fc343a9a2249954e2737cbdedef4bd5f5cc67d07b4b4532bd3cbcd73fed997cfaa07b9415064c08f035b07ccb90018a

  • SSDEEP

    12288:MaF8kdTrFTFJ3b0pcVYGyRIDOYswSLQLMZg2zRP5cu4FhH610QKhe:M68iJbicVYGxDOp+M/hj4/HwIw

  Score

  10^/10

  vipkeyloggercollectiondiscoverykeyloggerspywarestealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2