Extracted

Extracted

• • Target

    7ff42bacf844ade960d12cf1df99ce36be17f18903d2188e8de6d410033acaf1

  • Size

    1.2MB

  • MD5

    9d1b974a38b19a833b69f2bfdc0688f8

  • SHA1

    cbdf6cf01a69f8477cfc50d1cc1490457d28d7f3

  • SHA256

    7ff42bacf844ade960d12cf1df99ce36be17f18903d2188e8de6d410033acaf1

  • SHA512

    884c2fb4bd1d8b97fc153c0cc8dbcd0cf9d4eb5ed741fc2d1cd409735fe3f41e7382a7dc2ed21415753b4b5dd89ec7849ff0e21144ec988ed7c4b5e4e623cd41

  • SSDEEP

    24576:ffmMv6Ckr7Mny5QLSvogytmuL2T1101DTxGQ8X:f3v+7/5QLCItmce11KTcQ8X

  Score

  10^/10

  vipkeyloggercollectiondiscoverykeyloggerstealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2