Extracted

Extracted

• • Target

    Maosh qog'ozi.exe

  • Size

    357KB

  • MD5

    7eaadf6469c409d04d372f3ae56ebf87

  • SHA1

    9a21d453272387a014a47f843a3e495da11d1f74

  • SHA256

    c9db49c9cc19516d4a95548d1ce4ce1f36df8c40e690c14bcb547ddb1e789bb1

  • SHA512

    cfbf3b1c8cd0f5d57e0bebebbe7fe3abac73fe09854b8f26b5bd20c0413f786fb644f9d0c5f49bb6682e2a524ee34dc54dd95a80b752b5b47c05a88e5746077c

  • SSDEEP

    6144:NoIwxcKWibHiyvLZo4kczch/to9QK5cNVIFRvCOaGrgXak+tkl0Wc:NbKW6hzZowBCGr4aztkN

  Score

  10^/10

  vipkeyloggercollectiondiscoverykeyloggerspywarestealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2