Extracted

• • Target

    e4ee3b0145b6c859815fd11a158334d23fdb015f4d225ed6e0dae2a4a7c82777.exe

  • Size

    646KB

  • MD5

    34e3967c8143fb8822936f1a463b72df

  • SHA1

    ddd217ba236011c11af70a60e5942f345cc5039a

  • SHA256

    e4ee3b0145b6c859815fd11a158334d23fdb015f4d225ed6e0dae2a4a7c82777

  • SHA512

    4e1633b036e3dfe3405f6580903a938a7f6b43848e4408e2573478b4172e2236ccff8683f982c22cf2a70bf56c9967395ef7c7a5dd58a29cdf244aaa796dcc68

  • SSDEEP

    12288:wOv5jKhsfoPA+yeVKUCUxP4C902bdRtJJPiOHGu+4EIppaL+YQRUXi1h5QryNnts:wq5TfcdHj4fmboOci0kPNnmN

  Score

  10^/10

  vipkeyloggercollectiondiscoverykeyloggerstealerupx

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2