Extracted

• • Target

    Awb_000051224..exe

  • Size

    1.0MB

  • MD5

    385af6b596eb196b00f5e98ad9610d5c

  • SHA1

    86369c454882788520e46e529bc9c9315a0280b5

  • SHA256

    ce5cfba0bd5215b988c6a71324ec34b7cd0e5374f2123b251c84b27d404cf47d

  • SHA512

    bd889c11b3c1860afe2ec286be5cf49cd6fb748ff43c97b8957387acf6d1b64fbc1866ad562f252bd83dcfbb818ec71e209b8d7891d45d8fb3fdb237f7f072a4

  • SSDEEP

    24576:Ru6J33O0c+JY5UZ+XC0kGso6FadGU0zneWY:Du0c++OCvkGs9FadGU0hY

  Score

  10^/10

  vipkeyloggercollectiondiscoverykeyloggerstealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2