Extracted

• • Target

    3035c56d7c784bbcdd8dabed07cfb79fa360b263fd6a726575382b8489da132a

  • Size

    1.1MB

  • MD5

    4a374edfcf004d066dc1f2106fc3f424

  • SHA1

    02bfae32ce46ad8ac2f8071801a923358794076c

  • SHA256

    3035c56d7c784bbcdd8dabed07cfb79fa360b263fd6a726575382b8489da132a

  • SHA512

    26f705d618057e90541cff4240c51b1f4f634fb1030db4c91878064703ff2d735bfaa1c574bd23b75e57fa56995a0b9bf8ff04140a6599c577c60d5b003f5269

  • SSDEEP

    24576:1u6J33O0c+JY5UZ+XC0kGso6FaPrgV3+9zoWxPZ4QUKLBSeWY:Xu0c++OCvkGs9FaPrgx+9s+PBUKL0Y

  Score

  10^/10

  vipkeyloggercollectiondiscoverykeyloggerstealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2