Extracted

• • Target

    Syltetjsmad.exe

  • Size

    1.1MB

  • MD5

    cb8e38a904d97a2782cb38140f36e3fe

  • SHA1

    f9d77ffb188fed3bede9998a89b7362afcc52015

  • SHA256

    191ed5ad32b3e7df7a75dddfdc903bfc4f0a8c4cc4549db80b8f678b66fcba90

  • SHA512

    6200ba0b73b377cd702a446b1da9dbc032edbef8767012f0b109d1f803de653f16d6b0725ccee6346fe2082af814fa59220896b4d6461a19a7dec95717d2b095

  • SSDEEP

    24576:nNrNYoECbMDm/+/3VwV5k7j5awX300zQUGtZ:N+rCbGm/+/3VwXgj5aEkHUGtZ

  Score

  10^/10

  discoveryexecutionvipkeyloggercollectionkeyloggerstealer

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Vipkeylogger family

    vipkeylogger

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Blocklisted process makes network request

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2

• • Target

    $PLUGINSDIR/nsExec.dll

  • Size

    7KB

  • MD5

    675c4948e1efc929edcabfe67148eddd

  • SHA1

    f5bdd2c4329ed2732ecfe3423c3cc482606eb28e

  • SHA256

    1076ca39c449ed1a968021b76ef31f22a5692dfafeea29460e8d970a63c59906

  • SHA512

    61737021f86f54279d0a4e35db0d0808e9a55d89784a31d597f2e4b65b7bbeec99aa6c79d65258259130eeda2e5b2820f4f1247777a3010f2dc53e30c612a683

  • SSDEEP

    96:J9zdzBzMDByZtr/HDQIUIq9m6v6vBckzu9wSBpLEgvElHlernNQaSGYuH2DQ:JykDr/HA5v6G2IElFernNQZGdHW

  Score

  3^/10

  discovery
  behavioral3behavioral4