Extracted

• • Target

    FRA.2080 GRACARE MAIG (2).exe

  • Size

    528KB

  • MD5

    341ae38ffefa01cb1ce586636e6629db

  • SHA1

    ec0f4fa6942ef3aadc183d440239e883faeab607

  • SHA256

    2ff3d2bda15e7a1ceb97f318d9e85d930e6a75a135d70b953b708c96f90921a7

  • SHA512

    8b342bb4b381421be54a5876fba24cc6bccc1a0ecca48c6afb949b97645fdb69141e1dd1017d97fde3a3a080897a79534d0719119d4d2a076573b2c72fb98819

  • SSDEEP

    12288:aICiw3Giju9h1LrEOn1UuwE1eu0yoS/B3FYA1Y/:Miw2Uu9DLrEOnZwo/z/lJs

  Score

  10^/10

  discoveryexecutionvipkeyloggercollectionkeyloggerstealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Accesses Microsoft Outlook profiles

    collection

  • Blocklisted process makes network request

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2