Extracted

• • Target
    021337ISOGENERAL.exe
  • Size 431KB
  • SHA256 ce7202372e7e915e6cf9fb52e1ffe3083602f3a9b761f1d4b9e6045eabe065c1
  • MD5 d69326f0086f5a1915e317d460851185
  • SHA1 da4889b4a866fccf18cc4d580995d4e491459207
  • SHA512 f559b5584bccd64ee5784b3016b113f99f588be71ac19fc4adac850b993240d7596c91d3e85bc50a5290dd76ac3db3df7911d608f3c678ac4188db9c9b4757a5
  • SSDEEP 12288:bchSe04fsdrsdA6zKY/h1kMPJIN5yUBowyx9fag6vB:bqSe04s+61Y/LkMRSwgoxyrvB
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  vipkeyloggerdiscoverykeyloggerstealerguloaderdownloader

  • Guloader family

    guloader

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Loads dropped DLL

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2
• • Target
    $PLUGINSDIR/System.dll
  • Size 11KB
  • SHA256 bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb
  • MD5 17ed1c86bd67e78ade4712be48a7d2bd
  • SHA1 1cc9fe86d6d6030b4dae45ecddce5907991c01a0
  • SHA512 0cbed521e7d6d1f85977b3f7d3ca7ac34e1b5495b69fd8c7bfa1a846baf53b0ecd06fe1ad02a3599082ffacaf8c71a3bb4e32dec05f8e24859d736b828092cd5
  • SSDEEP 192:eY24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35Ol+Sl:E8QIl975eXqlWBrz7YLOl+
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10

  discovery
  behavioral3behavioral4